Overview

overview

10

Static

static

1

b3d2974e88...e0.exe

windows7-x64

3

b3d2974e88...e0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b3d2974e884a55f91e356067b1b03ee2f3772254df4cba83e64b84570ba7bfe0.exe

  • Size

    133KB

  • Sample

    240213-fbrtlsbb9y

  • MD5

    85123c41c1ba749deb56bf21f10a9309

  • SHA1

    e61f6db6962f486b3546b8f37157e295985367fc

  • SHA256

    b3d2974e884a55f91e356067b1b03ee2f3772254df4cba83e64b84570ba7bfe0

  • SHA512

    781315ca2b0493376bd5ace2509a3c44cc0d4e18102388783a5ec0630786d8fdcb08751d77b89016457470799a2cbd320f01bb95d90b6cd1d0302d39b09cbe47

  • SSDEEP

    3072:igmQTanuiRs37DrZ/c7GmCMY7pdk5nrTIXAJ:O1bRs37DZhATqAJ

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.normagroup.com.tr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $%M4,p)]vd1=

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.normagroup.com.tr
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $%M4,p)]vd1=

Targets

    • Target

      b3d2974e884a55f91e356067b1b03ee2f3772254df4cba83e64b84570ba7bfe0.exe

    • Size

      133KB

    • MD5

      85123c41c1ba749deb56bf21f10a9309

    • SHA1

      e61f6db6962f486b3546b8f37157e295985367fc

    • SHA256

      b3d2974e884a55f91e356067b1b03ee2f3772254df4cba83e64b84570ba7bfe0

    • SHA512

      781315ca2b0493376bd5ace2509a3c44cc0d4e18102388783a5ec0630786d8fdcb08751d77b89016457470799a2cbd320f01bb95d90b6cd1d0302d39b09cbe47

    • SSDEEP

      3072:igmQTanuiRs37DrZ/c7GmCMY7pdk5nrTIXAJ:O1bRs37DZhATqAJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks