Overview

overview

10

Static

static

5

0c7fc6fd42...30.exe

windows7-x64

10

0c7fc6fd42...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730

  • Size

    1.1MB

  • Sample

    241220-bhwnxswkgj

  • MD5

    d1642b4a6a94d085fabfd70a2ac37deb

  • SHA1

    6c00daa9f86d1afcdfdb47cf3a4555eb242d5d21

  • SHA256

    0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730

  • SHA512

    5d2e5645c943cc729a1daf24147a67334df9cdfddd90c693d5be606db255bfc131b4ddac6851e76404f0a0e32d8dc7417ee0521838fc81c72e562b413bc0f696

  • SSDEEP

    24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8ag4mjRxL:OTvC/MTQYxsWR7agp9x

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.alltoursegypt.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OPldome23#12klein

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730

    • Size

      1.1MB

    • MD5

      d1642b4a6a94d085fabfd70a2ac37deb

    • SHA1

      6c00daa9f86d1afcdfdb47cf3a4555eb242d5d21

    • SHA256

      0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730

    • SHA512

      5d2e5645c943cc729a1daf24147a67334df9cdfddd90c693d5be606db255bfc131b4ddac6851e76404f0a0e32d8dc7417ee0521838fc81c72e562b413bc0f696

    • SSDEEP

      24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8ag4mjRxL:OTvC/MTQYxsWR7agp9x

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks