Overview

overview

10

Static

static

5

rPO-450062...DF.exe

windows7-x64

10

rPO-450062...DF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rPO-4500628950_PDF.exe

  • Size

    1.1MB

  • Sample

    240123-vs4xtsdha7

  • MD5

    fdabbcde83da400e2008b7f972c87a80

  • SHA1

    ba546a0cb66bc25f2ceff43f6634acedf95a324b

  • SHA256

    dd808e48fe04077963b0b9b58b6d162499d8759acf3d046c4c0e1874459f813e

  • SHA512

    d42061ea5cc5c99be9253b1e79cf4f6edac680f1db006be866a7d97f446fa68dfd5df322205bef2dc4efd6706c46d724d435c1838e1dc24df3ea0f36058d1179

  • SSDEEP

    24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8a8U6nmf1l40au:HTvC/MTQYxsWR7a8U6m9a0a

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    kFxADjwNBm$_

Targets

    • Target

      rPO-4500628950_PDF.exe

    • Size

      1.1MB

    • MD5

      fdabbcde83da400e2008b7f972c87a80

    • SHA1

      ba546a0cb66bc25f2ceff43f6634acedf95a324b

    • SHA256

      dd808e48fe04077963b0b9b58b6d162499d8759acf3d046c4c0e1874459f813e

    • SHA512

      d42061ea5cc5c99be9253b1e79cf4f6edac680f1db006be866a7d97f446fa68dfd5df322205bef2dc4efd6706c46d724d435c1838e1dc24df3ea0f36058d1179

    • SSDEEP

      24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8a8U6nmf1l40au:HTvC/MTQYxsWR7a8U6m9a0a

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks