Overview

overview

10

Static

static

5

MACHINE QU...NS.exe

windows7-x64

10

MACHINE QU...NS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3a97b6abe98986f29149a790895ee275ca3450efec90b727e077918abb44afb

  • Size

    1.1MB

  • Sample

    250122-ls3v4a1lck

  • MD5

    5b620b100b165d2517686a2cc0522900

  • SHA1

    c8d3d2fde74d708d8b637d8a050117b09f5c9feb

  • SHA256

    a3a97b6abe98986f29149a790895ee275ca3450efec90b727e077918abb44afb

  • SHA512

    b97251bcbce3982820b782f07b32e0321d96aa2b08ce111fb49dc09f691c14eb995f573e2644bbf9a6eef794d08f60991f112f541d4b1063f81d84818c672cd1

  • SSDEEP

    24576:Gz7MzRMZHBO77jOIsSbtnxzggQRAYiYkng+Ak:OsMZaOIsSBRMbbFk

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.ercolina-usa.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    nXe0M~WkW&nJ

Targets

    • Target

      MACHINE QUOTATIONS.exe

    • Size

      1.6MB

    • MD5

      8fe6a25b6bc10fb2da65d47e78b15114

    • SHA1

      ec43904070fc8def0c04b57fb94dec4acb0fb008

    • SHA256

      90ce404cba04de876318ffd7282c216892edfa5d074d35d66f48ae02432f701c

    • SHA512

      d84c93df4ecdbff0014ca039bdc59e3e1d0cd934ea0bc33be3e061b958d1b760a927fb8ad463d9fc143e325866b6b1f735f504d9feb445eeaa86da1614cae71a

    • SSDEEP

      24576:Rtb20pkaCqT5TBWgNQ7aY3X3N5MG7JA9sRKA1rWCZ0lbi137Yb93qS5h6A:iVg5tQ7aYH3N5MGVAYhrRaFi13m605

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks