Overview

overview

10

Static

static

3

175c59f2f1...eN.exe

windows7-x64

10

175c59f2f1...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    175c59f2f17c0066effae9c9ea2556011f9913fafe8084d3336ba398339800aeN

  • Size

    1.1MB

  • Sample

    241004-dzpytasanr

  • MD5

    0e8a580592be5f5026123c4a0e1ee7c0

  • SHA1

    8510be426a37a0061ef081e2766203f3f572f663

  • SHA256

    175c59f2f17c0066effae9c9ea2556011f9913fafe8084d3336ba398339800ae

  • SHA512

    c81fa64adfdd26c5fa76f075798d224cf10bc6ab0f5fa26a45cb7503da6fc703c166c2a43bc4928aa1ea5954432583169b28e342f8e976f07a36f3a7ac509735

  • SSDEEP

    12288:p++PrU6YasBZbnT9pf0K+Dg0I6d3oxs7qFU/3JrjWfViu2cJinAYixFsqtgZLp:piBZbnJFx+Dp22S43JrSmYsqe9p

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    wenhuahui.net.au
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ceeboi123

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://wenhuahui.net.au
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ceeboi123

Targets

    • Target

      175c59f2f17c0066effae9c9ea2556011f9913fafe8084d3336ba398339800aeN

    • Size

      1.1MB

    • MD5

      0e8a580592be5f5026123c4a0e1ee7c0

    • SHA1

      8510be426a37a0061ef081e2766203f3f572f663

    • SHA256

      175c59f2f17c0066effae9c9ea2556011f9913fafe8084d3336ba398339800ae

    • SHA512

      c81fa64adfdd26c5fa76f075798d224cf10bc6ab0f5fa26a45cb7503da6fc703c166c2a43bc4928aa1ea5954432583169b28e342f8e976f07a36f3a7ac509735

    • SSDEEP

      12288:p++PrU6YasBZbnT9pf0K+Dg0I6d3oxs7qFU/3JrjWfViu2cJinAYixFsqtgZLp:piBZbnJFx+Dp22S43JrSmYsqe9p

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks