Overview

overview

10

Static

static

3

Bestellung...92.exe

windows7-x64

10

Bestellung...92.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Bestellung-Nr.24061189392.img

  • Size

    1.4MB

  • Sample

    240625-m3a4haydqr

  • MD5

    c9110ee0d9307d8b4e3e781d10fb013d

  • SHA1

    b33a2732ea1d39c9a187d2b623aa9045822feeae

  • SHA256

    fba970dee911640ec929dc11709ac9649d08565b07efbfe9e372ededd96b433e

  • SHA512

    654206fe18f807b98bf8ceb6f0eaf8974710a43acdaab7282fbaea4b21d3344b8ee959d3eda8c389717726a9eae596b9821243bb1f86cf64360b86b4d5875136

  • SSDEEP

    12288:jHGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:ARJSuMgl+JTP7QRJtD8

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.rusticpensiune.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    hr,d@KUwa5llI%*RNL^J]g%8I;!;_Ne#G1h~lE!*86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO

Targets

    • Target

      Bestellung-Nr.24061189392.exe

    • Size

      917KB

    • MD5

      2fac53d4021b54c213978d42c3969f69

    • SHA1

      9f9fdbeba0d6b5552b79379f5223f8a835852b8e

    • SHA256

      79b65ff6fce04514c36a1bd5290f8a0d71646a9a634714cd3fa35f7c0f7835ce

    • SHA512

      694f6cd20b9255245edc4be0b900f7373e9969872da5c5920df97d9aaa25adc9643e70c50e6d3575e78009e8889de3d8168efeaf6d3c81a812604dc20692e17c

    • SSDEEP

      12288:9HGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:iRJSuMgl+JTP7QRJtD8

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks