Overview

overview

10

Static

static

5

RFQ 105087...ms.exe

windows7-x64

10

RFQ 105087...ms.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    RFQ 10508786 Instrument Items.zip

  • Size

    601KB

  • Sample

    240531-qd47tshg6x

  • MD5

    4d8daf30031ec053b37a0a2b9b020e92

  • SHA1

    d599fac35f7aad02ab8757d522fc7f55505322d0

  • SHA256

    e75f4b205947a473b2ff1ad7e68f1d4caab2e18265440e03d1e177f8ba1db2d3

  • SHA512

    a4d04bee432974225722a97503524ca4d3a22509f1748da11bd73628bb02021d5f67f802aaa271e324663b9fb513051d0bb06b335a1e2a01090484192a5253a9

  • SSDEEP

    12288:0Gi2GcfQ7ORTLD8Wjf4pw1wPOp08vIxY479BiOFBwZ4BCtzwUGffE:0Gi5gQuTzXw2pvnZxYCt9n

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    u;4z3V.Iir1l

Targets

    • Target

      RFQ 10508786 Instrument Items.exe

    • Size

      1024KB

    • MD5

      4511552349b0dcfc93a0fe6ae0930690

    • SHA1

      5b527a7ee94301d1012085108a98d0fcfeeb9dc2

    • SHA256

      0771b5f6e8f1fce847a57f724edd31b9a39de68af92cf89a38581f75ee3247bf

    • SHA512

      e6d297f5a9fb334543cb7e95ba8a943501c7a16f7d64871711c75b5dbac9c37c22866f0f863e7736f277c1e1f7a076007646dfdc57cd4cec2104ee0976bc9c95

    • SSDEEP

      24576:UAHnh+eWsN3skA4RV1Hom2KXMmHaJIMzIgxcCd9T8E5:jh+ZkldoPK8YaJbxxFTr

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks