Overview

overview

10

Static

static

3

FACTURA-09...at.exe

windows7-x64

10

FACTURA-09...at.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FACTURA-098767k.bat.exe

  • Size

    2.6MB

  • Sample

    250117-jttbyaxmhz

  • MD5

    98e00105d9bdeb0c10a0987cb657b0b9

  • SHA1

    f5cb6141dc4eafa33aa03c5a2e2a9dd19af576b0

  • SHA256

    7cfd9f48da9d60e61380a3bf7b4bdde5a03817a7d95bfd9f84c228a2e313fab8

  • SHA512

    a7c27c4fc8b8a81d94172ae7199c42b7e6137f8e7c4cc7396042e927c35e47f65564968cc951a011ec9e5b73def8f622ed59d8f978ef973962ff579adcf56e1c

  • SSDEEP

    6144:6lEwrBTf7qi2dFXtYpJqCZ+Ub5nJnYa8kWZc3m9tJLK5E2XlXszMBug7Osngx2qY:ZSdtUFXtiP8oZUq7Gtg7vnml6

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      FACTURA-098767k.bat.exe

    • Size

      2.6MB

    • MD5

      98e00105d9bdeb0c10a0987cb657b0b9

    • SHA1

      f5cb6141dc4eafa33aa03c5a2e2a9dd19af576b0

    • SHA256

      7cfd9f48da9d60e61380a3bf7b4bdde5a03817a7d95bfd9f84c228a2e313fab8

    • SHA512

      a7c27c4fc8b8a81d94172ae7199c42b7e6137f8e7c4cc7396042e927c35e47f65564968cc951a011ec9e5b73def8f622ed59d8f978ef973962ff579adcf56e1c

    • SSDEEP

      6144:6lEwrBTf7qi2dFXtYpJqCZ+Ub5nJnYa8kWZc3m9tJLK5E2XlXszMBug7Osngx2qY:ZSdtUFXtiP8oZUq7Gtg7vnml6

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks