Overview

overview

10

Static

static

5

Orden de c...df.exe

windows7-x64

10

Orden de c...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10092024011309092024Ordendecompra0977086779870680675545.Pdf.uu

  • Size

    574KB

  • Sample

    240910-gwmk3a1drh

  • MD5

    da56b86c7fa519716d47a4eb6feb3e85

  • SHA1

    0f7ea407795298539d112fc98a0e924bc334b21a

  • SHA256

    c53d6c61a7b7eef78ed91936d1d304dc6ea46d7f1d9c15891e63e4d9096b41a5

  • SHA512

    dc5477a12a3aff4832805755d7e79fb39b0283c00f49fd447bbbdc055affea2dcb35564c4b534f15f89dd6b4d3728e989f6d6dc13e3e19a6f23c14694811184c

  • SSDEEP

    12288:5biCNFgsvSPNu9THlZ5OuKa9MRIBxPRWF2btf6xPTIi3afOw7RcSQCScWo:lBMsvMuHZ5OuyF2btf6xPWfOq+blY

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      Orden de compra_0977086779870680675545.Pdf.exe

    • Size

      1.0MB

    • MD5

      52ace262c8e6acdb7d63f959ee499772

    • SHA1

      76760b1c4e049c1ee6d7a2c5723d929bf013519d

    • SHA256

      4fb5281d2ac2e31416f64aa0ddcece35ac2ebea9fbe503dfdc8036a1289403ca

    • SHA512

      edf885bc1c52ded6a9d75d501d78a3240398fa093eada3b0441bc55d36e24a509057e1e6b78c3181a0e89caaa190ce6f934d287ea4933ff5b0b232afe77a725b

    • SSDEEP

      24576:Z4lavt0LkLL9IMixoEgeaU77jfpmBrEOwq9MmCS:okwkn9IMHeaUb4BrEDaPCS

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks