Overview

overview

10

Static

static

5

OC GDL48940.exe

windows7-x64

10

OC GDL48940.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d83f55e635f187273043e55b26141b397af08aaee2d7baf891c212426828312

  • Size

    800KB

  • Sample

    250125-bj9l6syrhn

  • MD5

    c2d815917f61f63e3a3ba2b2d5b08525

  • SHA1

    5b9b60c3ef7d5ad4d9fc6ae2698fd5217968f917

  • SHA256

    2d83f55e635f187273043e55b26141b397af08aaee2d7baf891c212426828312

  • SHA512

    3e9ae0cbdd0e2b7665f62c231c616968987207a2c5bec284d8e790f930fb123d75655388bdb3d6815b9ca7662946958de86373c5f1e94c9e24030881f4891395

  • SSDEEP

    24576:lVcneNZ10AJC3SDFw/SDVhjkDaMbbOUboCuweAY1Q6Nbx/1VW:gmyiFDnjkDDid8Y151Hc

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      OC GDL48940.exe

    • Size

      1.2MB

    • MD5

      bc4193c8697c930516e7f8a0b455efd4

    • SHA1

      8c949a64324491d76e0ff216dda5864d4fda874d

    • SHA256

      5420f805940014cf9e51372725194209e75017aaa65c73673ceab6751784fe1d

    • SHA512

      90d79ee2ce69c3cafb13bc319abe940267a3f5bb5c096bb16cce8b9a4cdc0e6c7fa2a347ee5b6608589fb9ee8c2c973f596bf520b88df0dd39fbb8088fb952f0

    • SSDEEP

      24576:IRmJkcoQricOIQxiZY1ia/FyzVpd944CPkjgdlMMpFV:tJZoQrbTFZY1ia/F2/Br8lMMFV

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks