Overview

overview

10

Static

static

5

d12dc1d25d...b9.exe

windows7-x64

10

d12dc1d25d...b9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d12dc1d25dc1d1ac1adce95a5aa1ff5ad85e5437dc840da5e849c024cb1e84b9

  • Size

    1004KB

  • Sample

    241120-bnnkhaxgln

  • MD5

    a6c06c401495906a3e4e4e0a28aed51e

  • SHA1

    5456cf96ac5f588b73a7e59053d0d24e0b69b592

  • SHA256

    d12dc1d25dc1d1ac1adce95a5aa1ff5ad85e5437dc840da5e849c024cb1e84b9

  • SHA512

    e167f3237e69bfb3f304c75606e73a5e967732d41e3204b952adc27a1d3c5b74083f9d7b20e3babba4d0c9ba60f7d25836ee8696e1eb21ee896320f539cb5197

  • SSDEEP

    24576:7u6J33O0c+JY5UZ+XC0kGso6Fa9FKwW3BJWY:1u0c++OCvkGs9Fa9FHY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    =A+N^@~c]~#I

Targets

    • Target

      d12dc1d25dc1d1ac1adce95a5aa1ff5ad85e5437dc840da5e849c024cb1e84b9

    • Size

      1004KB

    • MD5

      a6c06c401495906a3e4e4e0a28aed51e

    • SHA1

      5456cf96ac5f588b73a7e59053d0d24e0b69b592

    • SHA256

      d12dc1d25dc1d1ac1adce95a5aa1ff5ad85e5437dc840da5e849c024cb1e84b9

    • SHA512

      e167f3237e69bfb3f304c75606e73a5e967732d41e3204b952adc27a1d3c5b74083f9d7b20e3babba4d0c9ba60f7d25836ee8696e1eb21ee896320f539cb5197

    • SSDEEP

      24576:7u6J33O0c+JY5UZ+XC0kGso6Fa9FKwW3BJWY:1u0c++OCvkGs9Fa9FHY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks