Overview

overview

10

Static

static

5

ca2b636592...68.exe

windows7-x64

10

ca2b636592...68.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca2b636592073072d7d18c90447737b6f2969dcb89c9f0b672b797d63e5a5668.exe

  • Size

    1015KB

  • Sample

    240522-cwqkhahe6x

  • MD5

    b3d8677a4bc5a507cdd7614fe99390b2

  • SHA1

    677c75a7542312002b21d28860a5c9eedcdbdf19

  • SHA256

    ca2b636592073072d7d18c90447737b6f2969dcb89c9f0b672b797d63e5a5668

  • SHA512

    2a3af812775eb5dd134e7e129f049205a4a63e750882f6e554bb4e1b3d2fc1a8125e3575a3583c7c1989d3a039bd1757e01085d5bf3d3bfc2fa839d84681fc67

  • SSDEEP

    24576:EAHnh+eWsN3skA4RV1Hom2KXMmHaImXD/Tbs15:Th+ZkldoPK8YaImi

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    u;4z3V.Iir1l

Targets

    • Target

      ca2b636592073072d7d18c90447737b6f2969dcb89c9f0b672b797d63e5a5668.exe

    • Size

      1015KB

    • MD5

      b3d8677a4bc5a507cdd7614fe99390b2

    • SHA1

      677c75a7542312002b21d28860a5c9eedcdbdf19

    • SHA256

      ca2b636592073072d7d18c90447737b6f2969dcb89c9f0b672b797d63e5a5668

    • SHA512

      2a3af812775eb5dd134e7e129f049205a4a63e750882f6e554bb4e1b3d2fc1a8125e3575a3583c7c1989d3a039bd1757e01085d5bf3d3bfc2fa839d84681fc67

    • SSDEEP

      24576:EAHnh+eWsN3skA4RV1Hom2KXMmHaImXD/Tbs15:Th+ZkldoPK8YaImi

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks