Overview

overview

10

Static

static

5

RFQ 003711...17.exe

windows7-x64

10

RFQ 003711...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30092024231330092024RFQ003711840210884317.xxe

  • Size

    853KB

  • Sample

    241001-gywxhsydmc

  • MD5

    4c71147675394feae22a8f1718cdd4dd

  • SHA1

    49466d167087c14033b992273da51bb2f5b2b3af

  • SHA256

    1bbffffa310c2517cd4abdaeba3566208823e665ff373ef0b80ea69a525d54cf

  • SHA512

    3edd2ec8dc5538d8740a62d8190cf1e24c96c581d9930b324e185782606197530a3fe0b2cc2853657f6ab28f7b2662359cebfab212c32455e1f52fa89acbe261

  • SSDEEP

    24576:FQEv584qaF0S+V7tkt3iz9qfmNS0JEs8lezC1SaWZ:B5j5H+76tyzcf+L6CnZ

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.flujoauditorias.cl
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    l;0jGu7J;z_a

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      RFQ 003711840210884317.bat

    • Size

      77.0MB

    • MD5

      28ba9f4e74a31b5861393649efa5c238

    • SHA1

      b390e066d9c86e18e74c03fd8fe759ef47316112

    • SHA256

      142855d37c38914e779f360285d104e1485639d300d46b98cb54d82e34f8807a

    • SHA512

      f06175c44cf41982f04786602d0089831bd6fd104ed17299aa375e58ab2837d51bb88c4168fdbc529536128e179e11b4ecf26b3a78162e9e6024906a9c5720f2

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLOShGil3SoExqjVmYEL5Yl4udrWB:f3v+7/5QLOm1soExqjVyL5eDVW

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks