Overview

overview

10

Static

static

3

09a2c81607...5f.exe

windows7-x64

10

09a2c81607...5f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    09a2c816079b386a73ff74bc885bee5f

  • Size

    1.2MB

  • Sample

    231230-bjmseaadb8

  • MD5

    09a2c816079b386a73ff74bc885bee5f

  • SHA1

    24f1a52e44df2faf28820d539862e3b583b3083c

  • SHA256

    a4ec2ac3baad67429c9f8ea54690178bfb6e1af5adb6e95a2fae5748706b4dd0

  • SHA512

    6f14a1265ec66963df206478790b34cbc41a222d0781760b1e59d0e14edf1c1b96e80230bc06760d9bca5396d20f1aad1f906428e4b2af40df5e64aa497b5995

  • SSDEEP

    24576:U7MfWRkFYSblhBA1H7ufsZCaodvnksozfNqt55G:Vdyq1A1H7Wsc/nksoIL

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.adpfr.ro/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    PLAYBOY@123

Targets

    • Target

      09a2c816079b386a73ff74bc885bee5f

    • Size

      1.2MB

    • MD5

      09a2c816079b386a73ff74bc885bee5f

    • SHA1

      24f1a52e44df2faf28820d539862e3b583b3083c

    • SHA256

      a4ec2ac3baad67429c9f8ea54690178bfb6e1af5adb6e95a2fae5748706b4dd0

    • SHA512

      6f14a1265ec66963df206478790b34cbc41a222d0781760b1e59d0e14edf1c1b96e80230bc06760d9bca5396d20f1aad1f906428e4b2af40df5e64aa497b5995

    • SSDEEP

      24576:U7MfWRkFYSblhBA1H7ufsZCaodvnksozfNqt55G:Vdyq1A1H7Wsc/nksoIL

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks