Overview

overview

10

Static

static

7

ed7f33b059...dd.exe

windows7-x64

10

ed7f33b059...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed7f33b0598b170e6335ba236ddd4bdf7c5aa3dfe4f07819ad05a363a83d7bdd

  • Size

    664KB

  • Sample

    240327-be2qrsge43

  • MD5

    3e071651f4810a4f65a868bcc1984d45

  • SHA1

    2dd415b0eab962f01f18e367d66215141233534f

  • SHA256

    ed7f33b0598b170e6335ba236ddd4bdf7c5aa3dfe4f07819ad05a363a83d7bdd

  • SHA512

    f98ff709fd13c62b6985d06ba5dbd7b1ff525563a10e75139c49abe6a1ee53936092078b87cf4a0e8e88dfa76b72efc3b7f038e2220c85ea68327c1298a76abe

  • SSDEEP

    12288:/sHzOUNUSB/o5LsI1uwajJ5yvv1l2HB266mFGCuMJZrlY9aob80pprum7:OiUmSB/o5d1ubcvsBFFroFppru+

Score
10/10
agentteslakeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -GN,s*KH{VEhPmo)+f

Targets

    • Target

      ed7f33b0598b170e6335ba236ddd4bdf7c5aa3dfe4f07819ad05a363a83d7bdd

    • Size

      664KB

    • MD5

      3e071651f4810a4f65a868bcc1984d45

    • SHA1

      2dd415b0eab962f01f18e367d66215141233534f

    • SHA256

      ed7f33b0598b170e6335ba236ddd4bdf7c5aa3dfe4f07819ad05a363a83d7bdd

    • SHA512

      f98ff709fd13c62b6985d06ba5dbd7b1ff525563a10e75139c49abe6a1ee53936092078b87cf4a0e8e88dfa76b72efc3b7f038e2220c85ea68327c1298a76abe

    • SSDEEP

      12288:/sHzOUNUSB/o5LsI1uwajJ5yvv1l2HB266mFGCuMJZrlY9aob80pprum7:OiUmSB/o5d1ubcvsBFFroFppru+

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks