Overview

overview

10

Static

static

5

9559e7e1ea...c5.exe

windows7-x64

10

9559e7e1ea...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9559e7e1eace26c5bcb7d5ad4cc7eeb4f8f3a0b85a115b1e71eb459cb77044c5

  • Size

    1004KB

  • Sample

    241227-bdrt6sxmaj

  • MD5

    3aff4b03d8da510e877bee25bf071c5b

  • SHA1

    7f5ec92081cdc34531ff1506c769af0fd9825428

  • SHA256

    9559e7e1eace26c5bcb7d5ad4cc7eeb4f8f3a0b85a115b1e71eb459cb77044c5

  • SHA512

    c5f356afdccb99144edde73940c707cf8fe89470f62f4b32121523a2585915a948d6cb09de52cbf91c94dc599d5892681570e347f8c98853de948b4fc0ab8215

  • SSDEEP

    24576:Fu6J33O0c+JY5UZ+XC0kGsoTCcojZz7fINWY:Hu0c++OCvkGsECcoJ7ftY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      9559e7e1eace26c5bcb7d5ad4cc7eeb4f8f3a0b85a115b1e71eb459cb77044c5

    • Size

      1004KB

    • MD5

      3aff4b03d8da510e877bee25bf071c5b

    • SHA1

      7f5ec92081cdc34531ff1506c769af0fd9825428

    • SHA256

      9559e7e1eace26c5bcb7d5ad4cc7eeb4f8f3a0b85a115b1e71eb459cb77044c5

    • SHA512

      c5f356afdccb99144edde73940c707cf8fe89470f62f4b32121523a2585915a948d6cb09de52cbf91c94dc599d5892681570e347f8c98853de948b4fc0ab8215

    • SSDEEP

      24576:Fu6J33O0c+JY5UZ+XC0kGsoTCcojZz7fINWY:Hu0c++OCvkGsECcoJ7ftY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks