Overview

overview

10

Static

static

1

Unconfirme...08.rtf

windows7-x64

10

Unconfirme...08.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Unconfirmed 977108.rtf

  • Size

    69KB

  • Sample

    240425-nw4mxaac4w

  • MD5

    bd7a9eba72d2a2a8cc97260ec906b842

  • SHA1

    ecf9f969b5f2b687aaf73c6173807cdaad151adb

  • SHA256

    6dd61f18a3cd350daf98d26c0ce32c935fae9a5458ee6e0d8f9fa843be227e02

  • SHA512

    8eb5705bba4a86df8b08d3c9b7db67fa382541469905e3196c5d95f02ab77da5bfc60ba2316ae3c9102190bbf8bf09fd642889916a68c4d0452f4f911177ee69

  • SSDEEP

    1536:7LPx4QfgceatqBb1NTaYIjlQYYmatL6ZDngEaSa7XYtHoylWg3HK:7LZ4QoTatqBb1NTaYIRjyL6ZbhaSarYy

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    =A+N^@~c]~#I

Targets

    • Target

      Unconfirmed 977108.rtf

    • Size

      69KB

    • MD5

      bd7a9eba72d2a2a8cc97260ec906b842

    • SHA1

      ecf9f969b5f2b687aaf73c6173807cdaad151adb

    • SHA256

      6dd61f18a3cd350daf98d26c0ce32c935fae9a5458ee6e0d8f9fa843be227e02

    • SHA512

      8eb5705bba4a86df8b08d3c9b7db67fa382541469905e3196c5d95f02ab77da5bfc60ba2316ae3c9102190bbf8bf09fd642889916a68c4d0452f4f911177ee69

    • SSDEEP

      1536:7LPx4QfgceatqBb1NTaYIjlQYYmatL6ZDngEaSa7XYtHoylWg3HK:7LZ4QoTatqBb1NTaYIRjyL6ZbhaSarYy

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks