Overview

overview

10

Static

static

5

1c4ab8825d...86.exe

windows7-x64

10

1c4ab8825d...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c4ab8825d4ecf2599100b4ae7ef3c22dce95952e6f8c9891fb8a35bc3ff1e86

  • Size

    1.0MB

  • Sample

    241211-bkd7nayjhz

  • MD5

    66f4aeb652dd6200d3c4187fafa4c513

  • SHA1

    7fa99028b1d94aeea86df8aeb28a4e68ffb3f962

  • SHA256

    1c4ab8825d4ecf2599100b4ae7ef3c22dce95952e6f8c9891fb8a35bc3ff1e86

  • SHA512

    723d13c8fa3a103bb37b7d449046cdf505cbd2333ccd3811dc5e0c862491fe82fdb8dbe4c26105883e6f646d6bc048d2ece17417e69bbda3460ef2f1c9ebaac2

  • SSDEEP

    24576:eu6J33O0c+JY5UZ+XC0kGso6FawmVCOHdloLWY:wu0c++OCvkGs9FawmVCOHTY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.alltoursegypt.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OPldome23#12klein

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      1c4ab8825d4ecf2599100b4ae7ef3c22dce95952e6f8c9891fb8a35bc3ff1e86

    • Size

      1.0MB

    • MD5

      66f4aeb652dd6200d3c4187fafa4c513

    • SHA1

      7fa99028b1d94aeea86df8aeb28a4e68ffb3f962

    • SHA256

      1c4ab8825d4ecf2599100b4ae7ef3c22dce95952e6f8c9891fb8a35bc3ff1e86

    • SHA512

      723d13c8fa3a103bb37b7d449046cdf505cbd2333ccd3811dc5e0c862491fe82fdb8dbe4c26105883e6f646d6bc048d2ece17417e69bbda3460ef2f1c9ebaac2

    • SSDEEP

      24576:eu6J33O0c+JY5UZ+XC0kGso6FawmVCOHdloLWY:wu0c++OCvkGs9FawmVCOHTY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks