Overview

overview

10

Static

static

3

PURCHASED ...24.exe

windows7-x64

10

PURCHASED ...24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb46c7748fa22637eb41dece014af66ecebd6ea94ae2375312c3d2600d1bf8ef

  • Size

    1.2MB

  • Sample

    240220-b71deahf26

  • MD5

    55de00b8307367c09dee9b675e8a3dba

  • SHA1

    d98deb8be9696983d2f440eebbc19b62d6d521d8

  • SHA256

    fb46c7748fa22637eb41dece014af66ecebd6ea94ae2375312c3d2600d1bf8ef

  • SHA512

    87e205d266e0dbeb19e617af9431cb4a8989d854370c4b69e0f471acfd35547ed1b6ca7d8af81659242372e60e8aebc259ed0e7b3cae05cf03d0c2246ec64029

  • SSDEEP

    12288:USmPwRYnOELz89ppGJ/PKEP69P4fTwp2Ns8hGX8/bO/yJ8cPXN3Dc3es:USmP0Y74jA/G2NvGX8l9

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.lemendoza.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    boygirl123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.lemendoza.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    boygirl123456

Targets

    • Target

      PURCHASED ORDER -28723-24.bat

    • Size

      696KB

    • MD5

      dd59e5138b3a4d3bbfb0e5de7c865c35

    • SHA1

      c60a2d9657399e9c4e28b59551b4f0362493cd13

    • SHA256

      82be8e24f2ffefea05230b329f3129975598a930f3a3ff282b6b66c9d5821939

    • SHA512

      34f4dac17d63e4ed64092177ba0d5dfe780d817b790983f5a609f2e90e212f9eccd2e9790db9b0502cd83050829558eaa83ba7a7191235b9f135bec511015c84

    • SSDEEP

      12288:eSmPwRYnOELz89ppGJ/PKEP69P4fTwp2Ns8hGX8/bO/yJ8cPXN3Dc3es:eSmP0Y74jA/G2NvGX8l9

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks