Overview

overview

10

Static

static

5

scan_8374.exe

windows7-x64

10

scan_8374.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan_8374.exe

  • Size

    1.1MB

  • Sample

    241015-jeej8sscmg

  • MD5

    b7cd273b4b1c0746d1335b7ff2d6628b

  • SHA1

    2448b9570fecda5178d36721fc620443b0ec0ad4

  • SHA256

    be17d529f284ae34bed0c163e3b242127d65038e0eab024027635dfaeadcab61

  • SHA512

    583f7688e7f8b6951a6e0c5768cf5ec55382573dd2af2c8b17e85250be36f76e596a7b661d65e273d07d39f8a51839a81e4f26eb4c6923c244d7f1f88102a161

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLVo5ZKEZZ4iMOQ4fJQHv+F1Y:f3v+7/5QLW5Z3ZS6jRQHvJ

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $yxZKP=c)$k#

Targets

    • Target

      scan_8374.exe

    • Size

      1.1MB

    • MD5

      b7cd273b4b1c0746d1335b7ff2d6628b

    • SHA1

      2448b9570fecda5178d36721fc620443b0ec0ad4

    • SHA256

      be17d529f284ae34bed0c163e3b242127d65038e0eab024027635dfaeadcab61

    • SHA512

      583f7688e7f8b6951a6e0c5768cf5ec55382573dd2af2c8b17e85250be36f76e596a7b661d65e273d07d39f8a51839a81e4f26eb4c6923c244d7f1f88102a161

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLVo5ZKEZZ4iMOQ4fJQHv+F1Y:f3v+7/5QLW5Z3ZS6jRQHvJ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks