Overview

overview

10

Static

static

5

rTTSWIFT8374783.exe

windows7-x64

10

rTTSWIFT8374783.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rTTSWIFT8374783.exe

  • Size

    1016KB

  • Sample

    240522-xv275adb6t

  • MD5

    3f01bf70d956ec19a92b35f7a9c96c23

  • SHA1

    acb67c8df40ee9369cd18630282f4706a2bf2623

  • SHA256

    c2901aebb7af70fd74d9812932c5c7028711828696b3aa0f563cb6dfc82d22b9

  • SHA512

    37b9a414aca0c0b05a916094ae72faee8307f1568888d5ab65a84fd75332cd0142b34e1b9f7b4dcd41bce3d9c414669ad2c12e90a3ab7fa9ff2906fc6294cb16

  • SSDEEP

    24576:wAHnh+eWsN3skA4RV1Hom2KXMmHaFLfy4e33w5:nh+ZkldoPK8YaFLfW3G

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (=8fPSH$KO_!

Targets

    • Target

      rTTSWIFT8374783.exe

    • Size

      1016KB

    • MD5

      3f01bf70d956ec19a92b35f7a9c96c23

    • SHA1

      acb67c8df40ee9369cd18630282f4706a2bf2623

    • SHA256

      c2901aebb7af70fd74d9812932c5c7028711828696b3aa0f563cb6dfc82d22b9

    • SHA512

      37b9a414aca0c0b05a916094ae72faee8307f1568888d5ab65a84fd75332cd0142b34e1b9f7b4dcd41bce3d9c414669ad2c12e90a3ab7fa9ff2906fc6294cb16

    • SSDEEP

      24576:wAHnh+eWsN3skA4RV1Hom2KXMmHaFLfy4e33w5:nh+ZkldoPK8YaFLfW3G

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks