Overview

overview

10

Static

static

1

morningxla.js

windows7-x64

10

morningxla.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    morningxla.js

  • Size

    5KB

  • Sample

    240425-lpvejshe49

  • MD5

    8cf579f458819a211f06d8d115980db4

  • SHA1

    07a073341bb83d3ca8bd3ce21edaa5c3e631087a

  • SHA256

    65545c87941558733f8e159addc75b5f17e2597e05af3055a708fd49a6164f91

  • SHA512

    5fd3280406cc5e4c72209ea9712ee905e27b7804dd56c80ae1c33896a837c517a43485658be3095926457a35000d7f5521d6711092b8ebdaf948cbb5308bd7d6

  • SSDEEP

    96:7riEOkQDTAvKq8YjBPBERHnfrL3DGZzmwI7:HiEN1xAL3DGZzq

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    =A+N^@~c]~#I

Targets

    • Target

      morningxla.js

    • Size

      5KB

    • MD5

      8cf579f458819a211f06d8d115980db4

    • SHA1

      07a073341bb83d3ca8bd3ce21edaa5c3e631087a

    • SHA256

      65545c87941558733f8e159addc75b5f17e2597e05af3055a708fd49a6164f91

    • SHA512

      5fd3280406cc5e4c72209ea9712ee905e27b7804dd56c80ae1c33896a837c517a43485658be3095926457a35000d7f5521d6711092b8ebdaf948cbb5308bd7d6

    • SSDEEP

      96:7riEOkQDTAvKq8YjBPBERHnfrL3DGZzmwI7:HiEN1xAL3DGZzq

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks