Overview

overview

10

Static

static

5

65567 DHL ...60.exe

windows7-x64

10

65567 DHL ...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16102024_1542_15102024_65567 DHL 647765656798860.xlam

  • Size

    788KB

  • Sample

    241016-s5np9sxdrg

  • MD5

    f810715e7a4e396c3a380699c1d0314a

  • SHA1

    2790011ae85b36deed97c110c1e7da571ffdd5e4

  • SHA256

    5bd61b5c11c4974d775c645bb2e114ed12805fcc1613c7171a8c91f3fa5e6291

  • SHA512

    e71d2ecc115657aaa2b48d7d52ad5afdfc5cefb3bad908bc9611911a4fb8b83bafede2cce32c5b85425e939c8c79ccb72245d0e74332c209a98a9a15adebfba9

  • SSDEEP

    24576:BXk0FilGDo54iQezmPviZdu9TgWN6dipCyP:BXFS6aIezmPvmk9TgWosdP

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $yxZKP=c)$k#

Targets

    • Target

      65567 DHL 647765656798860.exe

    • Size

      1.1MB

    • MD5

      cf4176c218bed305b2084dacffbfe5f5

    • SHA1

      58e7b41ba755d09a9586929bcef7eccc5c1318af

    • SHA256

      6ea3566784f4d65b8198859ea7afc29a1eb7deea856d44628279067682e25665

    • SHA512

      e26aa65829e7aa7eafa0d2c4fcd18446210f745d5f3729cd67289206abeadd3d4ea2ad0d14e613ccd182e7fddf3c56ec68842ff9b21342d305de575754b52a74

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QL5Nk+Y+jeytDb7L7vAh6jS92MhF9AuPmp:f3v+7/5QL5N1dX7+6e92SF9Al

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks