Overview

overview

10

Static

static

3

Nueva ofer...z2.exe

windows7-x64

7

Nueva ofer...z2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d70310f811c8d2363043e469910c68190f4718e1ee42d1d2de3b2f53c4a197f8
  • Size 1.0MB
  • Sample241016-bj9beaveld
  • SHA256 d70310f811c8d2363043e469910c68190f4718e1ee42d1d2de3b2f53c4a197f8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials
  • Protocol

    ftp
  • Host

    ftp://ftp.alternatifplastik.com
  • Port

    21
  • Username

    [email protected]
  • Password

    Fineboy777@

Targets

    • Target
      Nueva oferta para COBRAL srl IMG-7263783-92829-bz2.exe
    • Size 1.2MB
    • SHA256 f6c07c1f1b936ac8da62b2a68392634053d0b39c2da4c7ba98e7b7e0ae9fbf94
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks