Overview

overview

10

Static

static

5

84b8c47f4f...6f.exe

windows7-x64

10

84b8c47f4f...6f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84b8c47f4fa7e736e66ac6401a0f01d60522cc644e225318acb787a25034586f

  • Size

    1012KB

  • Sample

    241120-bm5gmaxblc

  • MD5

    758ea76e22dd3e20eaffbdfab8df137d

  • SHA1

    392c5fe22196ff6ace463f0f40d02bc77753b4ac

  • SHA256

    84b8c47f4fa7e736e66ac6401a0f01d60522cc644e225318acb787a25034586f

  • SHA512

    abb042716e677eccd5eedcedd6b530eb15ffd0b08082540485ad4021dc818a71242e9a3e0bcbc974cabe1f09176c45fa8df0bcf96936f2895240e3b5e47c8855

  • SSDEEP

    24576:iu6J33O0c+JY5UZ+XC0kGso6FaEXVk382vWY:Eu0c++OCvkGs9FaElkCY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4r@d15PS!-!h

Targets

    • Target

      84b8c47f4fa7e736e66ac6401a0f01d60522cc644e225318acb787a25034586f

    • Size

      1012KB

    • MD5

      758ea76e22dd3e20eaffbdfab8df137d

    • SHA1

      392c5fe22196ff6ace463f0f40d02bc77753b4ac

    • SHA256

      84b8c47f4fa7e736e66ac6401a0f01d60522cc644e225318acb787a25034586f

    • SHA512

      abb042716e677eccd5eedcedd6b530eb15ffd0b08082540485ad4021dc818a71242e9a3e0bcbc974cabe1f09176c45fa8df0bcf96936f2895240e3b5e47c8855

    • SSDEEP

      24576:iu6J33O0c+JY5UZ+XC0kGso6FaEXVk382vWY:Eu0c++OCvkGs9FaElkCY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks