Overview

overview

10

Static

static

5

datos banc...df.exe

windows7-x64

10

datos banc...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    datos bancarios y código swift incorrecto009.pdf.exe

  • Size

    19.0MB

  • Sample

    240703-2xs5fsscle

  • MD5

    18e51a9ea1c46ff208964b6ce2c800fe

  • SHA1

    fcb4d0a173c7f12acf63cb271837cfd50970757a

  • SHA256

    7e2a64c75e7b25ea1be35a4fcb2716c4bf1f37cf050af226e1a9c252ae55f527

  • SHA512

    e4cdca089fddd0d283b8d148eaffa6321b32f69af70a213ebce93e50b19236c6eb1e2dcc068d1ef351e8e9cf4d3de0a529c77f0a58e630dbc1c04f2528e100a6

  • SSDEEP

    24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaLhe2k2Ahk75:ah+ZkldoPK8Ya1JPA2

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    =A+N^@~c]~#I

Targets

    • Target

      datos bancarios y código swift incorrecto009.pdf.exe

    • Size

      19.0MB

    • MD5

      18e51a9ea1c46ff208964b6ce2c800fe

    • SHA1

      fcb4d0a173c7f12acf63cb271837cfd50970757a

    • SHA256

      7e2a64c75e7b25ea1be35a4fcb2716c4bf1f37cf050af226e1a9c252ae55f527

    • SHA512

      e4cdca089fddd0d283b8d148eaffa6321b32f69af70a213ebce93e50b19236c6eb1e2dcc068d1ef351e8e9cf4d3de0a529c77f0a58e630dbc1c04f2528e100a6

    • SSDEEP

      24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaLhe2k2Ahk75:ah+ZkldoPK8Ya1JPA2

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks