Overview

overview

10

Static

static

5

b905a6ef2b...11.exe

windows7-x64

10

b905a6ef2b...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b905a6ef2b9eb0112dd70edabbfe2f064cb146efd691c0966e62e8689c8bc011.exe

  • Size

    1.2MB

  • Sample

    241011-cj6e7azdlf

  • MD5

    586400827bdbd6b6d675a7bd1ef997e6

  • SHA1

    52a61a129172822949ea7778c6ff87beba09589d

  • SHA256

    b905a6ef2b9eb0112dd70edabbfe2f064cb146efd691c0966e62e8689c8bc011

  • SHA512

    186e52f26ea457ad1b05f7cca9c9057066a4d8a51830e5f75329f893806baca91597b393d6a0b4b97f59cc2f282b1bb1d03ca883ec3a68069e344f08c494fdf8

  • SSDEEP

    24576:atb20pkaCqT5TBWgNQ7aZ2j2WRpKHK2ioM2HpvgLQ9YS6A:HVg5tQ7aZHWRpKH1JvsQ9T5

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.controlfire.com.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    0a4XlE=4t8mz

Targets

    • Target

      b905a6ef2b9eb0112dd70edabbfe2f064cb146efd691c0966e62e8689c8bc011.exe

    • Size

      1.2MB

    • MD5

      586400827bdbd6b6d675a7bd1ef997e6

    • SHA1

      52a61a129172822949ea7778c6ff87beba09589d

    • SHA256

      b905a6ef2b9eb0112dd70edabbfe2f064cb146efd691c0966e62e8689c8bc011

    • SHA512

      186e52f26ea457ad1b05f7cca9c9057066a4d8a51830e5f75329f893806baca91597b393d6a0b4b97f59cc2f282b1bb1d03ca883ec3a68069e344f08c494fdf8

    • SSDEEP

      24576:atb20pkaCqT5TBWgNQ7aZ2j2WRpKHK2ioM2HpvgLQ9YS6A:HVg5tQ7aZHWRpKH1JvsQ9T5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks