Overview

overview

10

Static

static

1

Tangforlsendes.exe

windows7-x64

8

Tangforlsendes.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24012025_0102_23012025_Comanda_PO_3296788003.img

  • Size

    2.0MB

  • Sample

    250124-bd2dlstmaq

  • MD5

    616dc7c8572ac62a84da1e520bc7f168

  • SHA1

    78cdb4b53832e27ff3591945cf7532bffb9e6e24

  • SHA256

    5c89ae8cf2f1416f78080c8511f455ebe8302061ad6370823f50c945900fa09e

  • SHA512

    bfabb999f3c0a10167af188b320aedd8f7efefc688de5dddd386c38020c0aea5ad587fe24cb31ec4255476387d5e0f4a000b0b414fdabae7df9d735d92e9c403

  • SSDEEP

    24576:HmwBXOxw33BYQ+0EnWF9gfJmc6Ns2VDdAVjaP+4a8ztxQX8F9toOSZD98+/1c:bXtY0iJ56nVQjaLa8ztisXuRg

Score
10/10
agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.carbognin.it
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    59Cif8wZUH#X

Targets

    • Target

      Tangforlsendes.exe

    • Size

      1.5MB

    • MD5

      2a3b0c09fb6332a4c35439c0741a3c61

    • SHA1

      1de70829cc27202b8b64235fb19829d32ac72ee1

    • SHA256

      67e5c1745d2c3382e6f20e2d7cd876acb687f7859aae4cd2b6b9fae6ca5a441e

    • SHA512

      901b724023e0ed87ddd483dae7c2c6c2269bb7115f1bfbf87a0b45efd77e20b7bcab183f60b1784ef92d86a6f04e76e719fe2a4d25794304ccc6aebd4bcd7f25

    • SSDEEP

      24576:vmwBXOxw33BYQ+0EnWF9gfJmc6Ns2VDdAVjaP+4a8ztxQX8F9toOSZD98+/1c:DXtY0iJ56nVQjaLa8ztisXuRg

    Score
    10/10
    discoveryexecutionagentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks