Overview

overview

10

Static

static

5

1f1b25f3cd...ff.exe

windows7-x64

10

1f1b25f3cd...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff.exe

  • Size

    1005KB

  • Sample

    240522-bmdnxafh2s

  • MD5

    0bc3bfaf81eda87fd049efb81e506545

  • SHA1

    422f10b51fc7d98b5c442393a26bc2c11a2265fd

  • SHA256

    1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff

  • SHA512

    fb97476c0d1a24f03d8e085471135521dccb7acbcb9d9b54b4310fac3c14e9e4d8188f5e5fdfd126f66c071ffdccae0621e2bf4e800237b17a268507aad9ead5

  • SSDEEP

    24576:VAHnh+eWsN3skA4RV1Hom2KXMmHaEt8d7G92q5:Eh+ZkldoPK8YaEt2G9j

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.corpsa.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -E~O8rekW5UT

Targets

    • Target

      1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff.exe

    • Size

      1005KB

    • MD5

      0bc3bfaf81eda87fd049efb81e506545

    • SHA1

      422f10b51fc7d98b5c442393a26bc2c11a2265fd

    • SHA256

      1f1b25f3cdad8e6c86d32be6d600f7ae9d2494bc0c50ec689d48e1e2df944dff

    • SHA512

      fb97476c0d1a24f03d8e085471135521dccb7acbcb9d9b54b4310fac3c14e9e4d8188f5e5fdfd126f66c071ffdccae0621e2bf4e800237b17a268507aad9ead5

    • SSDEEP

      24576:VAHnh+eWsN3skA4RV1Hom2KXMmHaEt8d7G92q5:Eh+ZkldoPK8YaEt2G9j

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks