Overview

overview

10

Static

static

5

nuevo pedi...11.exe

windows7-x64

10

nuevo pedi...11.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ead64374838036160dad06c3fef8dd60927fbdcc6db17d8a56c60212b3edb1fc

  • Size

    899KB

  • Sample

    250121-beax2syjgm

  • MD5

    2a5c16d7aba2e4007398980fece646c2

  • SHA1

    fc9e1e797bf3522ac770662294db0e804326919d

  • SHA256

    ead64374838036160dad06c3fef8dd60927fbdcc6db17d8a56c60212b3edb1fc

  • SHA512

    59c454e3ece7e4348c8be72e0117ac104d9831d19d5c798846adec20e917991b1c90ca6646d71aecfa6be7f9c88fcc05f43234617fe8a1194f3b886a026bb635

  • SSDEEP

    12288:mpJq+I+rk59TYZM1dBUTALAHikbzL+t6Z0I2K3hDzyB4bxTYkbkej6ZayuK:MJFrgtYZ02QAH1T0Q3h3b2cgaE

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (=8fPSH$KO_!

Targets

    • Target

      nuevo pedido PO00211.exe

    • Size

      1.4MB

    • MD5

      afe158e0cfaf6edb69a6b10d93e9693c

    • SHA1

      78ddfd4b6e756485e15f9b6e4c41716eb081595e

    • SHA256

      8485e51729ce9952159219b3576df7745a1254f655beb91c05fd53143250ee5f

    • SHA512

      0d1712d772534ce7bae6ce18726db1883ec9756f30f0d7978dcd405983bbf6d3dbd9905058ccff389eea691cb8497fc89cd4b86f7706b9ec1c4c809b93a8ea2a

    • SSDEEP

      24576:6tb20pkaCqT5TBWgNQ7a49nbTHCTNdSM3E479ghMzwfA87rL/UyHuK6A:nVg5tQ7a4dbT+YMU64MSh7rL/UyH95

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks