Overview

overview

10

Static

static

5

eabfe079cf...fd.exe

windows7-x64

10

eabfe079cf...fd.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    eabfe079cfa203e9ae41d7760eadf0bb989545f9246b96dec6e73abd031f29fd

  • Size

    1.1MB

  • Sample

    240202-cfn2qsdehr

  • MD5

    c7ad2fd60f80f5a2800ddfa7297dffd5

  • SHA1

    2526f65032f2af3714ef30cb52dc1ccc21988672

  • SHA256

    eabfe079cfa203e9ae41d7760eadf0bb989545f9246b96dec6e73abd031f29fd

  • SHA512

    a9c51c27b9b91716a52c175a2c63b5520634a3cbe1ba753aa22f4f42547ced76f42579936f5a541bb2ea95fc6c6dc37ae0b245793d2c41f9bcacafd1f23a6a2d

  • SSDEEP

    24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaVl1CtLRq85:uh+ZkldoPK8YaVluv

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.microempaquescali.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @EO$07[XSZw)

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      eabfe079cfa203e9ae41d7760eadf0bb989545f9246b96dec6e73abd031f29fd

    • Size

      1.1MB

    • MD5

      c7ad2fd60f80f5a2800ddfa7297dffd5

    • SHA1

      2526f65032f2af3714ef30cb52dc1ccc21988672

    • SHA256

      eabfe079cfa203e9ae41d7760eadf0bb989545f9246b96dec6e73abd031f29fd

    • SHA512

      a9c51c27b9b91716a52c175a2c63b5520634a3cbe1ba753aa22f4f42547ced76f42579936f5a541bb2ea95fc6c6dc37ae0b245793d2c41f9bcacafd1f23a6a2d

    • SSDEEP

      24576:jAHnh+eWsN3skA4RV1Hom2KXMmHaVl1CtLRq85:uh+ZkldoPK8YaVluv

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks