Overview

overview

10

Static

static

3

hesapharek...df.exe

windows7-x64

10

hesapharek...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    hesaphareketi-01.pdf.exe

  • Size

    2.8MB

  • Sample

    240614-wva8zavfnm

  • MD5

    6ef300bfb675f9f43ce9751bcde636a7

  • SHA1

    a689883c5be34d8af57336b8307bca8948193206

  • SHA256

    1c81c786a70496397e5c05b533473585322037875390aa522f8ffed43bf47c84

  • SHA512

    dc92f1f0bdafa0c8ba37e88703c1544cc418ddee6a92e73adb36dffd125da78b3e68d525b4dce2f345138cd2b9a257e5a3e5156747d4567226db0f91ce1bd33f

  • SSDEEP

    49152:SgpOmgDQ06m3N051GXdJCXw5Y9ehHwM1A8EfwosEm:MDDe4RhJHE

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    ozenmobilya.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ozennefes

Targets

    • Target

      hesaphareketi-01.pdf.exe

    • Size

      2.8MB

    • MD5

      6ef300bfb675f9f43ce9751bcde636a7

    • SHA1

      a689883c5be34d8af57336b8307bca8948193206

    • SHA256

      1c81c786a70496397e5c05b533473585322037875390aa522f8ffed43bf47c84

    • SHA512

      dc92f1f0bdafa0c8ba37e88703c1544cc418ddee6a92e73adb36dffd125da78b3e68d525b4dce2f345138cd2b9a257e5a3e5156747d4567226db0f91ce1bd33f

    • SSDEEP

      49152:SgpOmgDQ06m3N051GXdJCXw5Y9ehHwM1A8EfwosEm:MDDe4RhJHE

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks