Overview

overview

10

Static

static

1

ca3099d676...59.vbs

windows7-x64

10

ca3099d676...59.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ca3099d6765dafa126b2f5bd07e92de995a553de644d093c333e319fd37d1e59

  • Size

    1KB

  • Sample

    240307-bew6aacf34

  • MD5

    7836558d48626ee0a908838f533955c0

  • SHA1

    f6af952ac14eccb1a34028f57227436d296d4ce4

  • SHA256

    ca3099d6765dafa126b2f5bd07e92de995a553de644d093c333e319fd37d1e59

  • SHA512

    c9fa24e4991f00b45544d2648ef0408cccf44ee095911b0d25c6cea82eef0fd78bea7eade806a340bb58f2a838f828ca630465291b6a5ce9b2b163c3d9b5d3b5

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.bahattinmollamahmutoglu.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Bukky101@

Targets

    • Target

      ca3099d6765dafa126b2f5bd07e92de995a553de644d093c333e319fd37d1e59

    • Size

      1KB

    • MD5

      7836558d48626ee0a908838f533955c0

    • SHA1

      f6af952ac14eccb1a34028f57227436d296d4ce4

    • SHA256

      ca3099d6765dafa126b2f5bd07e92de995a553de644d093c333e319fd37d1e59

    • SHA512

      c9fa24e4991f00b45544d2648ef0408cccf44ee095911b0d25c6cea82eef0fd78bea7eade806a340bb58f2a838f828ca630465291b6a5ce9b2b163c3d9b5d3b5

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks