Overview

overview

10

Static

static

5

DHL_ docum...32.exe

windows7-x64

10

DHL_ docum...32.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10012025_1346_09012025_DHL_ documentos.pdf_987654576879808677967332.uu

  • Size

    886KB

  • Sample

    250110-q2ypysxrcl

  • MD5

    c1626febefba1ba2a2febadb18d5d3f7

  • SHA1

    a4cfac7766f0d95a2961c249ad192560c171e01a

  • SHA256

    6e229115e590aa260b957fd410ec14829f07c29b936fde7530b5a1c018bce53e

  • SHA512

    e147664b56e52e74058918bdbcd26cffc2d926b267b076193eec15a4073af4cbe0a30608fb0804df688d23c7cbb3fcd33bb5b5740f27ea8d4948bdee09d25518

  • SSDEEP

    24576:e1moM1FxW8nOqTJXyQ8fI8M0ryDETMlGbGE:gjM1lBXd83AETMlBE

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (=8fPSH$KO_!

Targets

    • Target

      DHL_ documentos.pdf_987654576879808677967332.exe

    • Size

      1.4MB

    • MD5

      2bae36bd65ef2cfd2dc402af53e1fee8

    • SHA1

      d6c4d530148cf07bde1e48cebe6a5d6491a1a459

    • SHA256

      662931dd6a126ad0fd04321718907cd90dc483a385d1552701d55f5b5c5242a6

    • SHA512

      57cee3dbb414669632b3597867e8c3799aa18d54329182ca94f8ea8895fae8fa490f168ca8742d31d1456c1ab8c13daf03ae60b083b66371ca9949be0cc73fbb

    • SSDEEP

      24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8a8QqVR3utL//cRyMpz:RTvC/MTQYxsWR7a8QPcVp

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks