Overview

overview

10

Static

static

5

96d6f7c32f...0b.exe

windows7-x64

10

96d6f7c32f...0b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96d6f7c32fcd7782290bce08f402bf880144fb40f24a5c016012892df58ef60b

  • Size

    1.0MB

  • Sample

    240425-bwemkada21

  • MD5

    75030156f385905a6672a9d9a259a602

  • SHA1

    cee9fd879705dc2c93f7519e36ddde60b7e993f3

  • SHA256

    96d6f7c32fcd7782290bce08f402bf880144fb40f24a5c016012892df58ef60b

  • SHA512

    a45644a2346f978209d0099de38ca2902a7f9ff9e94c2bdb8aacb4f714e33e6db7217cb86c9410f8444213c48a0bb7cf14c407b67969448fb370486ce66190e3

  • SSDEEP

    24576:oAHnh+eWsN3skA4RV1Hom2KXMmHaSsZt4uiGusKZ5:vh+ZkldoPK8YaSs34LhsM

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4r@d15PS!-!h

Targets

    • Target

      96d6f7c32fcd7782290bce08f402bf880144fb40f24a5c016012892df58ef60b

    • Size

      1.0MB

    • MD5

      75030156f385905a6672a9d9a259a602

    • SHA1

      cee9fd879705dc2c93f7519e36ddde60b7e993f3

    • SHA256

      96d6f7c32fcd7782290bce08f402bf880144fb40f24a5c016012892df58ef60b

    • SHA512

      a45644a2346f978209d0099de38ca2902a7f9ff9e94c2bdb8aacb4f714e33e6db7217cb86c9410f8444213c48a0bb7cf14c407b67969448fb370486ce66190e3

    • SSDEEP

      24576:oAHnh+eWsN3skA4RV1Hom2KXMmHaSsZt4uiGusKZ5:vh+ZkldoPK8YaSs34LhsM

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks