Overview

overview

10

Static

static

3

c3c4562cb7...98.exe

windows7-x64

1

c3c4562cb7...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c3c4562cb71bcb338f1fd481baab2367d485c84ddeebf0e41a1ac97fb0104e98

  • Size

    993KB

  • Sample

    240426-bm39kagg5w

  • MD5

    55853a89a9d4048b5438189c4df76c7a

  • SHA1

    18998068b836d0f5b1c0a137b8344857b0a27036

  • SHA256

    c3c4562cb71bcb338f1fd481baab2367d485c84ddeebf0e41a1ac97fb0104e98

  • SHA512

    08016375015d470d8a943188c61c51654d5efbfc4a48a9b9da174ccfa7f0b60bd541d0dbea3ad239870d7cc0744e2a6d186317d9d33e1301ba05e3f528e76280

  • SSDEEP

    24576:+wC9Dwa+7y9s21o5bs/7oG43YjImoL6IwMe2JK:WSRs1oNsBjIlLI

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.fashionfiberbd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    aziz**8060

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      c3c4562cb71bcb338f1fd481baab2367d485c84ddeebf0e41a1ac97fb0104e98

    • Size

      993KB

    • MD5

      55853a89a9d4048b5438189c4df76c7a

    • SHA1

      18998068b836d0f5b1c0a137b8344857b0a27036

    • SHA256

      c3c4562cb71bcb338f1fd481baab2367d485c84ddeebf0e41a1ac97fb0104e98

    • SHA512

      08016375015d470d8a943188c61c51654d5efbfc4a48a9b9da174ccfa7f0b60bd541d0dbea3ad239870d7cc0744e2a6d186317d9d33e1301ba05e3f528e76280

    • SSDEEP

      24576:+wC9Dwa+7y9s21o5bs/7oG43YjImoL6IwMe2JK:WSRs1oNsBjIlLI

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks