Overview

overview

10

Static

static

5

d307f2f082...0c.exe

windows7-x64

10

d307f2f082...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d307f2f0827aa2597a8242454b3c0d98d6e4bdc9b5ad91c5b9ee1f5e313e930c

  • Size

    1.0MB

  • Sample

    240706-brgalatgqc

  • MD5

    0423cb53e684de5e619270b8709f3000

  • SHA1

    370889bdf144f7cf100d37e61fafb89a1783a4a5

  • SHA256

    d307f2f0827aa2597a8242454b3c0d98d6e4bdc9b5ad91c5b9ee1f5e313e930c

  • SHA512

    ba8c895cb98e5c6c059dc26f7bf1d07d94d8712401fa85632c3ef65020224e88bdf78b98aab4a1f7b238d787b9c0fff34ca6d9c99b7c7874a06dc7b7feb55673

  • SSDEEP

    24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaKD7cYwW5:Kh+ZkldoPK8YaKDV

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.gizemetiket.com.tr
  • Port:
    21
  • Username:
    pgizemM6
  • Password:
    giz95Ffg

Targets

    • Target

      d307f2f0827aa2597a8242454b3c0d98d6e4bdc9b5ad91c5b9ee1f5e313e930c

    • Size

      1.0MB

    • MD5

      0423cb53e684de5e619270b8709f3000

    • SHA1

      370889bdf144f7cf100d37e61fafb89a1783a4a5

    • SHA256

      d307f2f0827aa2597a8242454b3c0d98d6e4bdc9b5ad91c5b9ee1f5e313e930c

    • SHA512

      ba8c895cb98e5c6c059dc26f7bf1d07d94d8712401fa85632c3ef65020224e88bdf78b98aab4a1f7b238d787b9c0fff34ca6d9c99b7c7874a06dc7b7feb55673

    • SSDEEP

      24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaKD7cYwW5:Kh+ZkldoPK8YaKDV

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks