Overview

overview

10

Static

static

5

7aa3559ffc...d0.exe

windows7-x64

1

7aa3559ffc...d0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7aa3559ffcbc86b1fd7cd0b5d59db2242cc890b2e90daa24951b53e9e017d0d0

  • Size

    1.0MB

  • Sample

    240605-bly88ahf8w

  • MD5

    7c2b1b7b516fd5e7cdf781b0d930e152

  • SHA1

    33ee65f199ed91d4b7d8f4bcaefa43fa5d97244f

  • SHA256

    7aa3559ffcbc86b1fd7cd0b5d59db2242cc890b2e90daa24951b53e9e017d0d0

  • SHA512

    9abc725e1438fcb9a64a5b5ef65f316f1bfe053236dfe418811e6ce73fc97bdfdfa192d8d009d51baeab816c5018d79eaac88192fddd3e2cc924f25dbd73aac2

  • SSDEEP

    24576:vAHnh+eWsN3skA4RV1Hom2KXMmHaevVehtkC5:Sh+ZkldoPK8Yaede

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.ultraflex.com.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Jgj8-p4Z]a1b

Targets

    • Target

      7aa3559ffcbc86b1fd7cd0b5d59db2242cc890b2e90daa24951b53e9e017d0d0

    • Size

      1.0MB

    • MD5

      7c2b1b7b516fd5e7cdf781b0d930e152

    • SHA1

      33ee65f199ed91d4b7d8f4bcaefa43fa5d97244f

    • SHA256

      7aa3559ffcbc86b1fd7cd0b5d59db2242cc890b2e90daa24951b53e9e017d0d0

    • SHA512

      9abc725e1438fcb9a64a5b5ef65f316f1bfe053236dfe418811e6ce73fc97bdfdfa192d8d009d51baeab816c5018d79eaac88192fddd3e2cc924f25dbd73aac2

    • SSDEEP

      24576:vAHnh+eWsN3skA4RV1Hom2KXMmHaevVehtkC5:Sh+ZkldoPK8Yaede

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks