Overview

overview

10

Static

static

5

SME940805N...16.exe

windows7-x64

10

SME940805N...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ebc5cab4f69a67790a4167032d2c71add575750e455b4355fa92114681273cb

  • Size

    779KB

  • Sample

    250118-bd2pdayqbn

  • MD5

    529cbd98b390cdcb8ef64ddb014a33b9

  • SHA1

    0e39e236c3b8f0d5a3a1cdb09514a967bdb49d89

  • SHA256

    0ebc5cab4f69a67790a4167032d2c71add575750e455b4355fa92114681273cb

  • SHA512

    3c954f8d294e4bc98a403a0ad6f94d701d98c1359836c870dffa9a94aeb2b659b506a637f5d8f724b27095e6f7edda9a9d9c15b67ea8d95be6d058a1c3ca9a19

  • SSDEEP

    24576:0U+Q7KyXet4FxeLoIbmRd/z9KxnvbSO0Ca25Q:0U193eDbmpwkCa25Q

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.solucionesmexico.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    dGG^ZYIxX5!B

Targets

    • Target

      SME940805NE7_Orden de compra_2866_20250116.exe

    • Size

      1.1MB

    • MD5

      a89f77e8a2f91014949f81da672f6654

    • SHA1

      5ebeeafdebe3e8e23595b7c41e9a8a9c437b06a5

    • SHA256

      59bc25224a04160935a4df38513d688345e6355bd6ce02493309aaf8ed9191af

    • SHA512

      67a28b7702c8b45451e2d2e22d6e449de26e3982fbcce451da43605d4d7dca17476babcc3fed844d99e39a047be2e71ec32746ab98e5a47bf1403106f3ff2e09

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCThE2DIEbR2uPtD1XF:7JZoQrbTFZY1iaCNwuP9dF

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks