Overview

overview

10

Static

static

3

8f575d27d1...cN.exe

windows7-x64

10

8f575d27d1...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f575d27d1098dd3de57b7bbc26ee14bc30327958b79cc9df4c2a321c1b6366cN

  • Size

    3.0MB

  • Sample

    240929-2gyp1atcjq

  • MD5

    b9e7c7924bea79f1af5444418c07a590

  • SHA1

    9e051cbfc09c7bc4c373041c9e2af2283684fe93

  • SHA256

    8f575d27d1098dd3de57b7bbc26ee14bc30327958b79cc9df4c2a321c1b6366c

  • SHA512

    b0920688539675a01fd857c906e356eabfc1031a5715a26deb9e52af102b25d73429b1cb4a7e20a87bf97be0457843a961790e60a0478233fd74e846d8d74097

  • SSDEEP

    12288:L94k9hWp8UFHyz5QsGkGh0uqrrEYKFcEpesfXesN:L1hWp8CHtsQqr3KFcEpeEesN

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.transotraval.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    vIZ2P]dt&a!d

Targets

    • Target

      8f575d27d1098dd3de57b7bbc26ee14bc30327958b79cc9df4c2a321c1b6366cN

    • Size

      3.0MB

    • MD5

      b9e7c7924bea79f1af5444418c07a590

    • SHA1

      9e051cbfc09c7bc4c373041c9e2af2283684fe93

    • SHA256

      8f575d27d1098dd3de57b7bbc26ee14bc30327958b79cc9df4c2a321c1b6366c

    • SHA512

      b0920688539675a01fd857c906e356eabfc1031a5715a26deb9e52af102b25d73429b1cb4a7e20a87bf97be0457843a961790e60a0478233fd74e846d8d74097

    • SSDEEP

      12288:L94k9hWp8UFHyz5QsGkGh0uqrrEYKFcEpesfXesN:L1hWp8CHtsQqr3KFcEpeEesN

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks