Overview

overview

10

Static

static

5

Updated Pricing.exe

windows7-x64

10

Updated Pricing.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    607f4e10f5684c3347dae95f8a528efb96d6a6e8c35a73a85fb263eb09da8b79

  • Size

    650KB

  • Sample

    240607-bkg9baga74

  • MD5

    b8cd64ba46b09c991b5b8254c38f359a

  • SHA1

    637a74f7d5c1b2aa762e6e7cba6763d32835e35b

  • SHA256

    607f4e10f5684c3347dae95f8a528efb96d6a6e8c35a73a85fb263eb09da8b79

  • SHA512

    da882bdb5d64b9a8f1202e63f5cbb4165f630664944af5eb1fceec52befa150adf13d2c0a6cdffb0d2db1762f4333fd5a68521611467cf1c8c876b1f7a2a51dc

  • SSDEEP

    12288:i9zA5D9wx/URn1so7IDz6Nl1f8vlXV/Okht1DcS8HGhhWcNcWvGPsrRv/Sv:MKD9wWR1QyNvAlF/OkGSNak3w

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    u;4z3V.Iir1l

Targets

    • Target

      Updated Pricing.exe

    • Size

      1.0MB

    • MD5

      f4f392937149925cbacb2b6cff753bc8

    • SHA1

      3987e2260aaf84730b7bf5b90c7709e990da020e

    • SHA256

      11e2c1e912c88d720c5cd73d4dc488f77a56d057062bb06ba75bcc5dd144a76e

    • SHA512

      c9eb8795a6d5149398a4493766a7b65531ae4920aedaeb5aea01b6209f3abcb82d53af7a22df350d7ebad6a46563736a8bbb121ca18f8b32e92c6ac99284ec04

    • SSDEEP

      24576:CAHnh+eWsN3skA4RV1Hom2KXMmHap+OkiYO5:Fh+ZkldoPK8Yapdky

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks