Overview

overview

10

Static

static

5

Comprobant...88.exe

windows7-x64

10

Comprobant...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8289824bd7bacf4edc69afae168ca1c96ae4bdc1a2f4f7826813ea72fc03964

  • Size

    530KB

  • Sample

    241119-bmf42ayhlr

  • MD5

    8ece9be0d2c1119ba2fdd4fde65f2e91

  • SHA1

    f73d5b829f76c3c76268f11c92e22ebc6b48b4a5

  • SHA256

    b8289824bd7bacf4edc69afae168ca1c96ae4bdc1a2f4f7826813ea72fc03964

  • SHA512

    304bc067e55e6c556d452771cb4917f4db3fbcbf59871259e3b87c4fbef47cb026b04aa867cd6c973b17500a907f2846e91e9f55a743ac5e1f696bff1a5cb4ba

  • SSDEEP

    12288:bNwl1DnlVMGexFHrNR8Duzos4f9tkqkAn4In:Rwl1DlVMhF/+NZtTkA4In

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4r@d15PS!-!h

Targets

    • Target

      Comprobante_swift_09093788.exe

    • Size

      72.0MB

    • MD5

      8f74b3fdd7b085f3c3def847662233af

    • SHA1

      a75f737ac40485c341f7085d72591b89e7c09d62

    • SHA256

      25ab1b7614199df29e69ae59542d296f3482834c205cdbcfb7422b46b9c06e04

    • SHA512

      3a74e6f24ee70d9e7391c7807b143fd1d8f3e00e54e4391236ac53feee708a442050d2439388702d911fe8c4df77a01fdfe90a888b93b4b022dcd0a808c45af0

    • SSDEEP

      24576:Uu6J33O0c+JY5UZ+XC0kGso6FaHDPVx47h4Wc5oWY:uu0c++OCvkGs9FaHD9W7URY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks