Overview

overview

10

Static

static

5

Envío de ...76.exe

windows7-x64

10

Envío de ...76.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    326062f8bec545360931fdb823fc7442ce42881b080e3fab1fa4bdfbb36ea748

  • Size

    519KB

  • Sample

    241120-bkpndsxfqp

  • MD5

    14e1caccfe941e672b1a9e114fd30e1c

  • SHA1

    0f8565f4233451c0bb06433e1e30efd3af0a5d2b

  • SHA256

    326062f8bec545360931fdb823fc7442ce42881b080e3fab1fa4bdfbb36ea748

  • SHA512

    7a8a65f4d338d7314c82e13d7c7a708f4f651efbaf412780a9ded95fe759a1d763ffece14e67ba933d4f14ee731d8f06dbe35c0418ac23b1e6527e6dea7a5d90

  • SSDEEP

    12288:ifSQL/IDAS83BwNmtzCIfIImpwVIdbUOLncvpo3HmZgGYXrvlJ:MSQKtuBwAOIfzmprdozkm+GY7v7

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    =A+N^@~c]~#I

Targets

    • Target

      Envío de Orden de Compra No. 4345643534465776.exe

    • Size

      1004KB

    • MD5

      a6c06c401495906a3e4e4e0a28aed51e

    • SHA1

      5456cf96ac5f588b73a7e59053d0d24e0b69b592

    • SHA256

      d12dc1d25dc1d1ac1adce95a5aa1ff5ad85e5437dc840da5e849c024cb1e84b9

    • SHA512

      e167f3237e69bfb3f304c75606e73a5e967732d41e3204b952adc27a1d3c5b74083f9d7b20e3babba4d0c9ba60f7d25836ee8696e1eb21ee896320f539cb5197

    • SSDEEP

      24576:7u6J33O0c+JY5UZ+XC0kGso6Fa9FKwW3BJWY:1u0c++OCvkGs9Fa9FHY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks