Overview

overview

10

Static

static

5

9e1e113d25...a1.exe

windows7-x64

10

9e1e113d25...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e1e113d2501bb734ed093ce55a5c2e85d0409fa757218d666d503ee449510a1

  • Size

    1.0MB

  • Sample

    241121-btbswsybjn

  • MD5

    fb3e13dd3fa5bbe5fb25c33362ba4d21

  • SHA1

    cb08ceef9c354cfc2c7ab3ae997c4f34fe16b58d

  • SHA256

    9e1e113d2501bb734ed093ce55a5c2e85d0409fa757218d666d503ee449510a1

  • SHA512

    daa9c4278ea0abb36ab6e72a148fc79666ed28fee3e3f1e8c1d616df0305f0408897ba82529fe83541b7a934ecafd22d6e33dd5c1a4f6d7b0ea1be786e18f805

  • SSDEEP

    24576:5tb20pkaCqT5TBWgNQ7auQnF9AiosG5w6FCq6A:KVg5tQ7auQF9Ai9Aw6FN5

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.elquijotebanquetes.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -GN,s*KH{VEhPmo)+f

Targets

    • Target

      9e1e113d2501bb734ed093ce55a5c2e85d0409fa757218d666d503ee449510a1

    • Size

      1.0MB

    • MD5

      fb3e13dd3fa5bbe5fb25c33362ba4d21

    • SHA1

      cb08ceef9c354cfc2c7ab3ae997c4f34fe16b58d

    • SHA256

      9e1e113d2501bb734ed093ce55a5c2e85d0409fa757218d666d503ee449510a1

    • SHA512

      daa9c4278ea0abb36ab6e72a148fc79666ed28fee3e3f1e8c1d616df0305f0408897ba82529fe83541b7a934ecafd22d6e33dd5c1a4f6d7b0ea1be786e18f805

    • SSDEEP

      24576:5tb20pkaCqT5TBWgNQ7auQnF9AiosG5w6FCq6A:KVg5tQ7auQF9Ai9Aw6FN5

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks