Overview

overview

10

Static

static

1

ea973e9c6f...05.exe

windows7-x64

10

ea973e9c6f...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea973e9c6f622a479e04107580a0ede92211fbd94b582d843e166fdc2d85dd05

  • Size

    682KB

  • Sample

    231208-cr7m8agf95

  • MD5

    55f2d796aae312c3ef0589c215749470

  • SHA1

    151d39760a5318f483ccdcc9829fad5ac8afab52

  • SHA256

    ea973e9c6f622a479e04107580a0ede92211fbd94b582d843e166fdc2d85dd05

  • SHA512

    e2e2d4699056203dcd2af6150e18727c6e54d3405504c5b5964a1f2f1f53c139d143d138395beede01886ab1a45e00fb72a65ae4e9238bf158289270767c3df8

  • SSDEEP

    12288:GwFGHEnT8VJWMB5VmjFvK4Nk35wxcCMjHaylgimtdYM3O0V7bb:G5HEgVJj8jg4k5jCMjhlgZtub0V7

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.vvspijkenisse.nl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    playingboyz231

Targets

    • Target

      ea973e9c6f622a479e04107580a0ede92211fbd94b582d843e166fdc2d85dd05

    • Size

      682KB

    • MD5

      55f2d796aae312c3ef0589c215749470

    • SHA1

      151d39760a5318f483ccdcc9829fad5ac8afab52

    • SHA256

      ea973e9c6f622a479e04107580a0ede92211fbd94b582d843e166fdc2d85dd05

    • SHA512

      e2e2d4699056203dcd2af6150e18727c6e54d3405504c5b5964a1f2f1f53c139d143d138395beede01886ab1a45e00fb72a65ae4e9238bf158289270767c3df8

    • SSDEEP

      12288:GwFGHEnT8VJWMB5VmjFvK4Nk35wxcCMjHaylgimtdYM3O0V7bb:G5HEgVJj8jg4k5jCMjhlgZtub0V7

    Score
    10/10
    agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks