Overview

overview

10

Static

static

7

PO-4500628950.pdf.exe

windows10-1703-x64

10

Resubmissions

22-05-2024 13:56

240522-q86n5sdg34 10

22-05-2024 09:52

240522-lwg3ssbb22 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO-4500628950.pdf.UU

  • Size

    558KB

  • Sample

    240522-lwg3ssbb22

  • MD5

    1a5ff1660d6575fc7b407bd4a4506726

  • SHA1

    e1108f1294d2e0a13567c1a2420a2105d1830fa7

  • SHA256

    960bdbfae30525b6c4e9e0a72dbc85c9858e9ee6133141ad31e1e22701115c15

  • SHA512

    b19ba9ab477161258f5b1895a4e257cb345dfcdb47555309ea1f2bb2f05e57b689a56fa0dc9310577253f3258c9a2011612947bb93d3cae686453f06c65517fc

  • SSDEEP

    12288:msDn3+6v/L5Jo9uAG93tAw5ZrNnPJbXz0XDR+EWVACjMJwPhnr:mAB5JmuAalZrN1zWDqVACjWwP1

Score
10/10
agentteslakeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -GN,s*KH{VEhPmo)+f

Targets

    • Target

      PO-4500628950.pdf.exe

    • Size

      583KB

    • MD5

      4414baebd8634b34f822bb4afc2378ed

    • SHA1

      7a28187f4cb67e18e8ebdc2a38658541f30407d9

    • SHA256

      a60cf278af314c5950ff0e4f94f9915038c3f2582dc46782333cba764e0dacaa

    • SHA512

      580510f75d61df2c1c4c97ccd70e7bc332957bfa8b0d0306732d8002a4fdc0aefa16b4888b6761572c80a5cbe1466b6e884a61bceb98cd126baba19e61b8b970

    • SSDEEP

      12288:9YV6MorX7qzuC3QHO9FQVHPF51jgcd3i6c/bCItCaHWikxm8M:SBXu9HGaVHI6cTntCaHWDJM

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix

Tasks