Overview

overview

10

Static

static

5

bc3bb7cdc4...56.exe

windows7-x64

10

bc3bb7cdc4...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc3bb7cdc4c87d2888c0c64f15f9953a79da7baa2d31874dd168db28f2b79256.exe

  • Size

    1.0MB

  • Sample

    250111-fl5s8avndv

  • MD5

    f3dc9b8005c8237c3ad3a186af2a6ade

  • SHA1

    c7a53f05a6c630787fbde778ac6e882f0e7a1e34

  • SHA256

    bc3bb7cdc4c87d2888c0c64f15f9953a79da7baa2d31874dd168db28f2b79256

  • SHA512

    9923d3ab52dcd94188b2d7423c78dc9829db12b3d9c5e6599060f22c18b70aa3223d722ae38d4ce5ee2dafb64314f00f22d23fcfc24c2aaa3faceb5f3c64314c

  • SSDEEP

    24576:mu6J33O0c+JY5UZ+XC0kGso6Fa2qLCT7MPWY:ou0c++OCvkGs9Fa2qiY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.jeepcommerce.rs
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Q6]7rLSD*gU2

Targets

    • Target

      bc3bb7cdc4c87d2888c0c64f15f9953a79da7baa2d31874dd168db28f2b79256.exe

    • Size

      1.0MB

    • MD5

      f3dc9b8005c8237c3ad3a186af2a6ade

    • SHA1

      c7a53f05a6c630787fbde778ac6e882f0e7a1e34

    • SHA256

      bc3bb7cdc4c87d2888c0c64f15f9953a79da7baa2d31874dd168db28f2b79256

    • SHA512

      9923d3ab52dcd94188b2d7423c78dc9829db12b3d9c5e6599060f22c18b70aa3223d722ae38d4ce5ee2dafb64314f00f22d23fcfc24c2aaa3faceb5f3c64314c

    • SSDEEP

      24576:mu6J33O0c+JY5UZ+XC0kGso6Fa2qLCT7MPWY:ou0c++OCvkGs9Fa2qiY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks