Overview

overview

10

Static

static

3

54d3c03fe5...90.exe

windows7-x64

10

54d3c03fe5...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54d3c03fe5a809ceca2a7357f2fc15b5f0be1bae4653665af8c8b5c1b99ff990

  • Size

    3.1MB

  • Sample

    240612-bwvnsaxgjg

  • MD5

    1a9a48c0b395b922fffe54adb58e2a72

  • SHA1

    b6f496fa40770c67bfddbd247100d02a87431002

  • SHA256

    54d3c03fe5a809ceca2a7357f2fc15b5f0be1bae4653665af8c8b5c1b99ff990

  • SHA512

    e33e35ad1a6b2a4dd131b11872f00b3378f06f23c68e2d9d00d720439cee4bf25406fda97f565778596efbce4ef866ee238ffdb95ae2f9d81dc739827b2b625a

  • SSDEEP

    49152:o8yJAk206NICMq5pzKRgqVzKZEgFsgSomkUt73G:vBs6Q

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    terminal4.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ifeanyi1987@

Targets

    • Target

      54d3c03fe5a809ceca2a7357f2fc15b5f0be1bae4653665af8c8b5c1b99ff990

    • Size

      3.1MB

    • MD5

      1a9a48c0b395b922fffe54adb58e2a72

    • SHA1

      b6f496fa40770c67bfddbd247100d02a87431002

    • SHA256

      54d3c03fe5a809ceca2a7357f2fc15b5f0be1bae4653665af8c8b5c1b99ff990

    • SHA512

      e33e35ad1a6b2a4dd131b11872f00b3378f06f23c68e2d9d00d720439cee4bf25406fda97f565778596efbce4ef866ee238ffdb95ae2f9d81dc739827b2b625a

    • SSDEEP

      49152:o8yJAk206NICMq5pzKRgqVzKZEgFsgSomkUt73G:vBs6Q

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks