Overview

overview

10

Static

static

3

M0000B Req...df.exe

windows7-x64

10

M0000B Req...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ae5e7576e3e268c5d301cd653b540412fca6e6b5a5f8efc611a995fc36933510

  • Size

    1.4MB

  • Sample

    240616-bp2hratbpb

  • MD5

    1074cca9f1013110840d588e2b72f1ff

  • SHA1

    8260d41c9e0708b28f17467792096a7f8b75d30e

  • SHA256

    ae5e7576e3e268c5d301cd653b540412fca6e6b5a5f8efc611a995fc36933510

  • SHA512

    dc5c2a7e981a533634ca34274e85a3ff41a015b1b5fb265ac5e91506256399e2c3d31fa82f424f2ad4ae9839ea4608ee74e4213027fb6095c22240f30e53e3f7

  • SSDEEP

    24576:FTJz2MBrzuxR6OwLnlJ2Vk/wq9D9gj99QF1iAzefNBlcpFU:FTvzQhelJsk/wSKjTMPkfp

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    ozenmobilya.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ozennefes

Targets

    • Target

      M0000B Requisition form.pdf.exe

    • Size

      2.8MB

    • MD5

      01d0fd052f583ddee7c23860d437fa0e

    • SHA1

      0c027385b3a87cb2d2ae63a199e00ee468623d8e

    • SHA256

      117864e2e63bdafe3be560806bcc49c7701e524d173d867e0069cc2cc591692b

    • SHA512

      452279616d17d9ac430ca98607cc15cc65f4b8489dc4f4d4eb160f76afacf230602cb6c14fee6915b5aca5363b24564403c67b10df8b5788a9f16b2213dff2ed

    • SSDEEP

      49152:SgpOmgDQ06m3N051GXdJCXw5Y9ehawM1A8mfwosQWN1:MDDe4RhEHFD

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks