Overview

overview

10

Static

static

3

HGJ7688.exe

windows7-x64

10

HGJ7688.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    774e023a499aeb816e91997f91f75bc5c1ff0ccbb829a91405e031a1bbe97fc6

  • Size

    1.1MB

  • Sample

    241225-belpjssqbq

  • MD5

    89e1c437ebed19d940101ab60a7ba0f2

  • SHA1

    33553225382be27da70b59db297380c741b765ec

  • SHA256

    774e023a499aeb816e91997f91f75bc5c1ff0ccbb829a91405e031a1bbe97fc6

  • SHA512

    96c7e06f3e274a71557a7cc85c9dc9667df57cef33f90bd474e61870eed34fc664b8afc3c396c7ab7808536722cea4d45225271674116c3967b4400c117d7efc

  • SSDEEP

    24576:Qj2ydGBSV7Kp/QCpm6TBDawyA/LaddFSjqSnFW53I7DOZCi:QKydGBSVTf6TkwXaBSjqZInOZ3

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      HGJ7688.exe

    • Size

      1.6MB

    • MD5

      3e41f9112dbf536b22fe43f5da1e4255

    • SHA1

      8dd5d8ad791103f1bb68ef16f7553066d6235569

    • SHA256

      1627a54d0ecbd6b1a92755383488e7f50f0311f8fbbad850db051d1e80f54be6

    • SHA512

      688b76288f58182796d53510c5632af5113b447406e64b79e953db94eee031b9e8f0aec64e4549a9a572fd3d0bed231fbf8d86aec0b801111c7b8f6e1d14ce92

    • SSDEEP

      24576:c8u/Vjs+4S+/3qlrCNoh+UagIwhCNoh+JR9FrIJJpCNoh+7qy4/fGVhVqNqIjjuB:c8u/VQZ/iJO2URoGqhGJqNqlInut

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks