Overview

overview

10

Static

static

5

Tender _Re...wg.exe

windows7-x64

10

Tender _Re...wg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Tender _Requirements.Dwg.exe

  • Size

    1.1MB

  • Sample

    241017-h3jcnaxcmc

  • MD5

    99447b8c6fb3b85be61f297a04b03915

  • SHA1

    158bb729aed3bb1f0f52eb2387fe7c591349346b

  • SHA256

    c25f1c1a67501d9ad73df00aa11c40b474158c32185c4360bdc86e61fb88f7d4

  • SHA512

    9783af6141dbf4cf62ef8478a40d6a436fd3a9fb37d3633ced7dddca7cce9a3787161eb26c772b2bff94be78b2e814e2ae7ac0ff3890db814e2b70b9f5f3b562

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLG6kt5yMAuc9x0o4ZNoWxotORN/:f3v+7/5QLG6kyyTRjFo4/

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $yxZKP=c)$k#

Targets

    • Target

      Tender _Requirements.Dwg.exe

    • Size

      1.1MB

    • MD5

      99447b8c6fb3b85be61f297a04b03915

    • SHA1

      158bb729aed3bb1f0f52eb2387fe7c591349346b

    • SHA256

      c25f1c1a67501d9ad73df00aa11c40b474158c32185c4360bdc86e61fb88f7d4

    • SHA512

      9783af6141dbf4cf62ef8478a40d6a436fd3a9fb37d3633ced7dddca7cce9a3787161eb26c772b2bff94be78b2e814e2ae7ac0ff3890db814e2b70b9f5f3b562

    • SSDEEP

      24576:ffmMv6Ckr7Mny5QLG6kt5yMAuc9x0o4ZNoWxotORN/:f3v+7/5QLG6kyyTRjFo4/

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks