Overview

overview

10

Static

static

5

Notificaci...K).exe

windows7-x64

10

Notificaci...K).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30582cd517f7c4ba6812df4c9a2ddcf64476d794c3c34ed972a342e96372d7dd

  • Size

    521KB

  • Sample

    250124-bj3tmaslay

  • MD5

    929dec2b2a7311ac97ae101d8aac5c22

  • SHA1

    f66f30b00313523ee97ad37ed97af01e90eabb9e

  • SHA256

    30582cd517f7c4ba6812df4c9a2ddcf64476d794c3c34ed972a342e96372d7dd

  • SHA512

    142061c010f7295752b4de16debf8535629c946562c602b356e1c1ed00d7810f8ec5bb624e2d2f4e179c0ce5cf37f749ef2c5b5340329e5858d2afc47d4719db

  • SSDEEP

    12288:QPmsk/7gPVVxN6rU3VgbmKcTm6/26JacrmVG0fLleca2ZF/4u:KIMPbxsxam6JaMmM0fC2ZF/

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.solucionesmexico.mx
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    dGG^ZYIxX5!B

Targets

    • Target

      Notificacion.pdf (26K) Notificacion.pdf (26K) Notificacion.pdf (26K).exe

    • Size

      1005KB

    • MD5

      ca278d1f75ba838c94bbcd345efaeb2a

    • SHA1

      799d4a14d169577b093cd940af3665aa74cd6e96

    • SHA256

      d41958cd03f3b6a5d35bfffbe5ac6433df12e1219958e7a2e6e79ccfb8c9163f

    • SHA512

      a3ee4b8b74b2fd1c0baa4ec4deccf6caf3348e2a250b302d7d7d2f6dc896f490e81e58159a19df9fe0b6d82e291109f9df3be79d53c8b61e5260c40d120e5cb7

    • SSDEEP

      12288:3CdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga8T5a2N8GdM:3Cdxte/80jYLT3U1jfsWaM5a2N85EpQ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks