Overview

overview

10

Static

static

3

Ordine n°...80.exe

windows7-x64

10

Ordine n°...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    838bcd6a993a9fa7601030fb2d85e5789afca334365d6f359be9733e6e6559c0

  • Size

    585KB

  • Sample

    241214-bgjmzatqbp

  • MD5

    e7d3397afa577102c61d81bf688c2db4

  • SHA1

    043ca1a521f53e81da0c2bb4a39bb0b864029588

  • SHA256

    838bcd6a993a9fa7601030fb2d85e5789afca334365d6f359be9733e6e6559c0

  • SHA512

    8a72bc25dc876e2d87b176e909cd16ddfb4da4e9b39177f9b0d85473d82ee89edd77a0ec10f85fda6edc3e707b0cc84afc1776b1cf02ff26fb480891fa37eca4

  • SSDEEP

    12288:P6JvVxvUb1cMLAMicQNNSp1dAHPqCMH6LNT/fE/ZRYIfTdtm67:yNxWNicQNNStAHPqC3/c/8Qe67

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.transotraval.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    vIZ2P]dt&a!d

Targets

    • Target

      Ordine n°24-00980.exe

    • Size

      588KB

    • MD5

      109d45c3b8f2be7efd8a1c72b58a7219

    • SHA1

      1ac06fdb16045dd3f2654b9e610fcf8abf53cff1

    • SHA256

      bc8c295e4538bde3e11a4a7604107998fc0b473cc7685462886fc97fbcd9d454

    • SHA512

      4a71e436ef8a4e19f7db733003b001026ca4333a6d558cad41ddac25d29bb452e5dc6f6526f330f8b0665b9d1c95cdef2258fd50a89f0167e6a9f61569081861

    • SSDEEP

      12288:JbcDSPWvpV5m057P2mqPCt15Zncw03El3183jbU2P:e2PWvpVk+2wdle3/U2P

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks