Overview

overview

10

Static

static

5

FACTURA CO...F2.exe

windows7-x64

10

FACTURA CO...F2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4e783a0c2ebf625b2d5d472ed40e9372e0da02d36e10cdeca8176d91370c7df

  • Size

    796KB

  • Sample

    250117-bdevlsxpdq

  • MD5

    52c6d3050468e7ba52d73b8c2959b693

  • SHA1

    e306fe863189cbf8869d00eab2b13a0e111bb998

  • SHA256

    a4e783a0c2ebf625b2d5d472ed40e9372e0da02d36e10cdeca8176d91370c7df

  • SHA512

    75623d5dc12fa7b332c76999de0388ec1c1a6862b918b6e4cc06b2f62e557b3925253997c2e121e9eee11d31e044cfe84eb68ef60456bbd0884bffb141e8bf4e

  • SSDEEP

    24576:XU+Q7KyXetMYtqYNN5Rz1aHZ4cOjCEVzls:XU19TYk0+f+ls

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.solucionesmexico.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    dGG^ZYIxX5!B

Targets

    • Target

      FACTURA COTIZACIÓN_________________________________________________PDF2.exe

    • Size

      1.1MB

    • MD5

      ab4e93b58e6095f90e36faebafd8fe83

    • SHA1

      4fad58ea18fc56b68fbc9c041907ad3d7eddd86d

    • SHA256

      c64e5665fc0fc87c200343d352bda7b933a9e19608998b22979be0cf4f88371c

    • SHA512

      0ae6246c9b500f05113144712259df6e4cd569b7ae6c5a1fb1c43d93141ebe1347014e7ed76b5d45fac24741ae336204c14f60aa8efd741ccb1db16e06d63c01

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCe5aO2OUooxi9C3O/5PS5WJG:7JZoQrbTFZY1iaCewO2Otei91BKAJG

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks