Overview

overview

10

Static

static

5

696e6560f1...bc.exe

windows7-x64

10

696e6560f1...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    696e6560f1ed56c42bab8272a7873778b3568827a3a2a8f4fb2df7194846a6bc

  • Size

    1018KB

  • Sample

    240521-b8wfvaec76

  • MD5

    89676c25910874298ea25e99f7d04196

  • SHA1

    d1b5f2073d71617cc53be1125c160bb13a57e953

  • SHA256

    696e6560f1ed56c42bab8272a7873778b3568827a3a2a8f4fb2df7194846a6bc

  • SHA512

    06be3ab5e319b39a5d6c35beff9479f851eba49c6aa8a76b461bc7efd95a478485ca15e7f7cd59b2de8bfae50865af400a81a2d85749db5277ab0898ddcf70b8

  • SSDEEP

    24576:yAHnh+eWsN3skA4RV1Hom2KXMmHahqHtW1H5:1h+ZkldoPK8YahqH0D

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.midhcodistribuciones.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ,A7}+JV4KExQ

Targets

    • Target

      696e6560f1ed56c42bab8272a7873778b3568827a3a2a8f4fb2df7194846a6bc

    • Size

      1018KB

    • MD5

      89676c25910874298ea25e99f7d04196

    • SHA1

      d1b5f2073d71617cc53be1125c160bb13a57e953

    • SHA256

      696e6560f1ed56c42bab8272a7873778b3568827a3a2a8f4fb2df7194846a6bc

    • SHA512

      06be3ab5e319b39a5d6c35beff9479f851eba49c6aa8a76b461bc7efd95a478485ca15e7f7cd59b2de8bfae50865af400a81a2d85749db5277ab0898ddcf70b8

    • SSDEEP

      24576:yAHnh+eWsN3skA4RV1Hom2KXMmHahqHtW1H5:1h+ZkldoPK8YahqH0D

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks