Overview

overview

10

Static

static

5

0328678647...98.exe

windows7-x64

10

0328678647...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15102024_0028_14102024_03286786476_formulario bancario98.uu

  • Size

    817KB

  • Sample

    241015-ascs5athjh

  • MD5

    2548bdad74093708574593ce91ae1677

  • SHA1

    ad5499c7d4192e1d5e933e215b7bcfbb6d319fab

  • SHA256

    10e65477c5713e52a40a5c10997a117169c89984a11699d7a1e059be24564803

  • SHA512

    780c39f53bb9b52b28a3b69ffc99e19b6f766b61fbaa0e9155ed2b20067d4b05d896b722c6fd0574c2018adb6cffce394c1044d00c48d5e0048b4e4997c23724

  • SSDEEP

    24576:guWAk7867YpjznkBjDRfGX5ZRivL6675nwY4gq97Q:PmTgjzkNUzgvR9nwYI0

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -GN,s*KH{VEhPmo)+f

Targets

    • Target

      03286786476_formulario bancario98.exe

    • Size

      1.3MB

    • MD5

      8f6dd2f16d810cbc7e0e5fffd80f7cf6

    • SHA1

      05c7cffb2576db07eb17a1c074474d555ffa3cac

    • SHA256

      c5c8835e9f94b24d38f0463a15392b6e27a79214a1e6e743f5cd535c096b507e

    • SHA512

      22053407a1a2b83fed160f1563d25c69711111f5260dd1a9a08e8c733e5e4163b0395c50ff305cef8c86e5882d698bd5726ef02189fc62a0e1e3bfecb23f7f24

    • SSDEEP

      24576:atb20pkaCqT5TBWgNQ7aVCtgwy+sZnIDL8TdFr22MEcTD4m/6A:HVg5tQ7aVCtgMUY8pFr2htH4E5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks