Overview

overview

10

Static

static

3

HBL,MBL CN...74.exe

windows7-x64

10

HBL,MBL CN...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    604594b37c8e9f144ea1de6692f41d6feb705bd8925f5d836011b9ec763cf0be

  • Size

    170KB

  • Sample

    241116-byeeksxcla

  • MD5

    b5092319b2b30d6827f5ba16cd042020

  • SHA1

    ce50d5316643e6787b6084693fc62c711ff1b6b7

  • SHA256

    604594b37c8e9f144ea1de6692f41d6feb705bd8925f5d836011b9ec763cf0be

  • SHA512

    09f6e7f318816883cfeafd0a2a3c146ed01c424828b0999218429b711ae356a8e48827af0a0a149ab34e1cd35d29ebe65fa78855cb4666d98a9101fb1f72ef1a

  • SSDEEP

    3072:dmysvIpSf+gWaYzB5jxgeTlD3yk2hwDdxWdlqjCQX7zmkfFNxJq+TRfdeD:oysQpwi/nlekGnD4XPzNxJdY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    $yxZKP=c)$k#

Targets

    • Target

      HBL,MBL CN MBL NO.OOLU274.exe

    • Size

      768KB

    • MD5

      6e52d06cde9fbf957369659a4243faec

    • SHA1

      7a015e133cb8f1d156569c41bdac576665a4ab4f

    • SHA256

      d4719004280501b5675b81449dc5cd9ed62dec2b35910f5b2322826cae5227a8

    • SHA512

      2affdd8fdc5fbb60bd13d41121f5981ab25f19dce4a91cfac5fc9f84372ba6a416387aef62f14db0b15580561a9142c46153500c36b07b86408045bc214c248e

    • SSDEEP

      6144:H5w4OqX+PmmsFQKChgCGunyluH5D8zG1tseCx8GRdoNie:HRZTeYe

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks