Overview

overview

10

Static

static

5

TNT AWB #8013580.exe

windows7-x64

10

TNT AWB #8013580.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b629f4e3f910044870bf9b144bd456dd11d90745a9d8a93cdfddd415f87e73a

  • Size

    749KB

  • Sample

    241017-btrt4svbrh

  • MD5

    beb15a6c342235a7562ab8734890f034

  • SHA1

    22ad8d93c2e42e8b91a5294ef7cc98ee14127b04

  • SHA256

    7b629f4e3f910044870bf9b144bd456dd11d90745a9d8a93cdfddd415f87e73a

  • SHA512

    58b8638e2b2444e3380b7438818d360d8e8cb8e43d5da48344e89bb67a9c55653e315740d7e2566b88d9b194ca9798a51e504c1c375819c7dd2d84da16174e4f

  • SSDEEP

    12288:iUPVfPEAk0bBilG1do54i9i4feoKUWKPGEEl3YlayKrt8q7Hy242CG2WpFKwnESR:1Xk0FilGDo54i9peoK/6s3kbqWwy3G2I

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $yxZKP=c)$k#

Targets

    • Target

      TNT AWB #8013580.exe

    • Size

      1.1MB

    • MD5

      c47ace837644869c835c9af43fc6459a

    • SHA1

      01c6172e95997b9cff95ee19fd26e5cbde51878a

    • SHA256

      bc730e4dcb485c438fd37fc02ebe9ae731be9daf4988478dc625aaa9f01b2597

    • SHA512

      24d243322e0a6cc965922792cf8c8cb2e3b963b2e62f96f2a1fdca38185f70403a356a729897e1e127f173f45474d5e51d6791ec2ae37be9a90509706007721a

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLgOEOP0sEMfT4EUV+1L66jsEj:f3v+7/5QLGUnRE6jsC

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks