Overview

overview

10

Static

static

5

PI confirm...df.exe

windows7-x64

10

PI confirm...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b1fb30a10d3f28b2818d2237d0b117f214e6895e27322769b352b489deadcd3

  • Size

    538KB

  • Sample

    250123-bmwvgswlbm

  • MD5

    87ba8298b0294284dc6a68e072ac89d8

  • SHA1

    b357b3fae02b6edcf23ff3397e1dae6d7ba2bdf5

  • SHA256

    0b1fb30a10d3f28b2818d2237d0b117f214e6895e27322769b352b489deadcd3

  • SHA512

    de12f8fef5324007b969a43ab1e724f14bd973606a1c0f4d7cbc5cfcd31a5318fe80330a7664e6dda3b14cb59a26925a2706b3377ebee3b01019a64a3bcc0025

  • SSDEEP

    12288:P2f41YVxNbXBJ59wmYjRgjOskNVmE26AsfP/gnMZjp/Ci6BVec2FMmmg4Mv:OQkxTxwmeRgjOtuh6BPInM9F6LpECg4S

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.solucionesmexico.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    dGG^ZYIxX5!B

Targets

    • Target

      PI confirmation 24853942034.pdf.exe

    • Size

      1022KB

    • MD5

      b5ee430dd6835a1a6d1e9bec76e042a6

    • SHA1

      475d6d6f34c14c99658a14bdcf4ff473c857bd34

    • SHA256

      2a6ff1cef657a6538c13bcb0608838dabf1a7d129b6f6cdec87090da94b73519

    • SHA512

      f8d251536fae464c7affed7c0d56109ad6ebfeaea63d063325a7be3c5ff5302fb9f215b61cbdfa8197612c192849be289cda5212ab0144e55943a0776314f6f9

    • SSDEEP

      12288:gCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgajTwgRkl6nG:gCdxte/80jYLT3U1jfsWa3nkU5EM3LQ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks