Overview

overview

10

Static

static

3

BstkDDU.dll

windows7-x64

10

BstkDDU.dll

windows10-2004-x64

10

BstkRT.dll

windows7-x64

10

BstkRT.dll

windows10-2004-x64

10

Factura n�...33.exe

windows7-x64

1

Factura n�...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28f8d9684a26ccf1f127b2296b2d3a89df746fafe3ee181aa643b00b536caea7

  • Size

    2.7MB

  • Sample

    250118-bgj9hayqhq

  • MD5

    dd0ad223a4048fbe7dd8e0ea101a5765

  • SHA1

    ee95b52ce7b199b47d0d478912b9625f2efb01df

  • SHA256

    28f8d9684a26ccf1f127b2296b2d3a89df746fafe3ee181aa643b00b536caea7

  • SHA512

    48e29cfbf0a32f7c5923379c3387455a2b137d49b03546a66ae680c0fab4a3a0f2623fd881b84b9a363341858f5abf772a033e3904975f2e3682e3e522bd3d6f

  • SSDEEP

    49152:8pIqY1R+lf2LkNbPYC5v09kfQkRREIjsk/Vd65u8nZOwZO06Hj7gc/5AKb9xagw4:6f2L6LFMe4kRRtsktuJZOwWfgMhb96/Q

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.transotraval.cl
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    vIZ2P]dt&a!d

Targets

    • Target

      BstkDDU.dll

    • Size

      451KB

    • MD5

      5ea0e72799f7ab9d3f426f77e02499f5

    • SHA1

      03f91e09564f19f99953d82924d3437df3de5b8d

    • SHA256

      f7a3464b99eff79164de42b98a8d3bc3944c758386d5e446541030e205501049

    • SHA512

      e0ca46a585e434fdc6ba735afe94f73dbb3ff4b8b97b32801f8d20739e869c4f41e5287dd9fc90a0cb3f8d1a25e004cd0335a7b43cdae53959d79f92e0e3b836

    • SSDEEP

      12288:7RejOcRw0FRIOK9pcwWvni+Jr/cUkc8OIgWi9klTX:FcOcRwgRIDp6Z/cUkE9klTX

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      BstkRT.dll

    • Size

      5.7MB

    • MD5

      7f06fa2333e9eb3700f4f392a9568af0

    • SHA1

      358421b295b07035c1b97ed1fb75797262354bd6

    • SHA256

      ed16489a57bfedb0388fdc4d09e06019e043eb8a32d66e50a3322af5026e85ed

    • SHA512

      c8742cacec3c3e5dd77916b420399ab4a0245f202524172965bde6ff4f9de8019a2ff84e594d7818e0eb735f5ee353b43e171793da6acf5df0e8e0d5ec78adcd

    • SSDEEP

      49152:GCidpajVSru1InXGnodk56GNSqvYfERzh5GtbbLJmjDfSo3daSfyIBCFp+cBLJ7a:crLe6GNtfyqfKIwOcBLJ7YgtTwk

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      Factura nº 9194633.exe

    • Size

      1.6MB

    • MD5

      28f954593b46b475f4a38135b0fa5280

    • SHA1

      4ad163cdc14bcb4c25cd6e9881bd1c8c2b18d20d

    • SHA256

      ea789703ffd411a8b7706f230e4f41b531d1beeb49de0b7221095461e33f06b8

    • SHA512

      c9befe00750d25b9755676a988fe11308a03406e85f0e5113e0c89738e4440542fd1dcdaa6ca9144314cb7c4ee0f3e1647b3595d8917e57ffeb2e8b61e455a77

    • SSDEEP

      49152:446QlvaBVVYm+dHcj06ri8aDiR1qS+IqblHo7nYKiUWjPgU9bAd7rmDaMiUffAq4:4fQlSBVVYm+dHcw6ri8aDiR1qS+Iqbl4

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks