Overview

overview

10

Static

static

5

DHL ESTADO...7..exe

windows7-x64

5

DHL ESTADO...7..exe

windows10-2004-x64

10

DHL ESTADO...57.exe

windows7-x64

10

DHL ESTADO...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb93832c7e81e80c658302b90b225b566d0d0fa411a0c78ac548b6705b81f228

  • Size

    1.6MB

  • Sample

    250117-bfgf8axkat

  • MD5

    c996c1647f7c5026ffc2fbf7b4295538

  • SHA1

    85eae9dab0f86b3416a6b392f6f0b567ef535c66

  • SHA256

    fb93832c7e81e80c658302b90b225b566d0d0fa411a0c78ac548b6705b81f228

  • SHA512

    f2177e333448f8fa4c484e2ae566a14f110356652491e5198ce68eed26a01a9607b4119c8ae791555c8fb8df7b5ce53834e98e2b8104432fd47772b22448816a

  • SSDEEP

    24576:4AWaTrRyfk4XYoJ+nwH/Tjvnz4qsATGICS8IZpkuk3YUPlU+Q7KyXetJgR4QjpCt:4BHXfTjvz4KGAUsUPlU19Vk6r0zV

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (=8fPSH$KO_!

Targets

    • Target

      DHL ESTADO DE CUENTA - 7664557687757..exe

    • Size

      938KB

    • MD5

      6093303017b7a7bc7da70d82eadcc1e5

    • SHA1

      0a54dafcf21e908658db8c968ac144200462f404

    • SHA256

      ca48eb6ba51153c4b0674da66234a5925daaf036a8b20a7d4aacbf40619b35ed

    • SHA512

      ec3ed99dc1c1b4537e36c28d325add376555b97d855a9d5280931f3834fcf42260ae37b7c51e1ca753a19ab4f016c0326abfc8a89c66454877d16989ad4fcf24

    • SSDEEP

      24576:xiUmSB/o5d1ubcvq/IrcTJOf6cMPFRvwHrQMsriJxX5OM9hpy:x/mU/ohubcvq/mcTJOdiaLQfrWxpr9v

    Score
    10/10
    discoveryupxagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      DHL ESTADO DE CUENTA - 7664557687757.exe

    • Size

      1.1MB

    • MD5

      cce9839eba85aebebcac4739a21e4798

    • SHA1

      c0bcf9a10b2c9806bfa11a0eac3f267e01657e5e

    • SHA256

      e338c65f26adfe0dd82ed76ad548b34673df5759c3d18712c10b4d772cf60e84

    • SHA512

      e665d5d5025028159e3aeedcff6a197b7f97f548387ac9ff9cd564657bd8a68073e6b2baa75a39ec76c3cf9c6cdf310e50216f8785d7f88cf5ad57ffd1178c18

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaC5BJlD8vR4ct9LlAF:7JZoQrbTFZY1iaCHvD8ZX9L6F

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks