Overview

overview

10

Static

static

3

Faktura Pr...43.exe

windows7-x64

10

Faktura Pr...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Faktura Proforma OFFPF22003343.uue

  • Size

    803KB

  • Sample

    250109-p49dsszpez

  • MD5

    c589f7d5ac17ca59aeaf1c8790863698

  • SHA1

    43f88ae4daed5eb845ec9939cc229709cc0c6e34

  • SHA256

    bb276352d849a39b4e06945ecb6c35cafeca374fba92703635963e7fde3fe0ad

  • SHA512

    180b3d192d8e326a6347352dbe2fb805924879f74fa38cf461ffe85d462f6e8f1d04a56f9b1ba3b6b0831e0d3b3468ba80dbcd74b48a62671853558de9f792e9

  • SSDEEP

    24576:xuSRkarQx5V/RPhS6SZIl9pWfrAseXjhvLqr1jXkQ2:LSarQ/1S6SairAsuNLqJjkQ2

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.transotraval.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    vIZ2P]dt&a!d

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.transotraval.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    vIZ2P]dt&a!d

Targets

    • Target

      Faktura Proforma OFFPF22003343.exe

    • Size

      1.6MB

    • MD5

      09796122d01b36659f08e2aa52fc897e

    • SHA1

      653384c03301ce437e5fdb68fe7a6b89be1896ad

    • SHA256

      3b223ba05fff7ab4c99f154b3a6deb09bab933442309a09b27ae242ddc1002b2

    • SHA512

      1ed17479596cf0d2982d77884451f346da0b10e19ac9c787944ad4279d4fb0c7295dd411e8b8b0092e12bcb15a78464dae76a0af3454d9d69d4e150c8cceba26

    • SSDEEP

      49152:KAodtaG9kS2U84B+FLan9k5TRM9zlgVjhSaq4P:+/B1TaZP

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks