Overview

overview

10

Static

static

5

Orden de c...74.exe

windows7-x64

10

Orden de c...74.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0156f6e3597a4c58a87b8e64a85fe5988c2de3608b3e10a51c190c4620fe9cb

  • Size

    514KB

  • Sample

    250127-2qctwsynbm

  • MD5

    27c667fd07d70c2317fa1ea42679ec70

  • SHA1

    cea626029b09b31517a611b6e8191ae86e40e6c9

  • SHA256

    b0156f6e3597a4c58a87b8e64a85fe5988c2de3608b3e10a51c190c4620fe9cb

  • SHA512

    a6af6f9c4cef5e5ec80bddf14b9c7d9e51cb8049bd0700685cfb5b538f15f4f383e1473194a8acb668b07f1561b32fdcc518c9b83564fc7c3583cdd9fa0455d9

  • SSDEEP

    12288:zHWZ2ysM9RZ1/uXIp37iboV6c9nopS3rIl/DzU+IwlB:z2ZIMzZ9uY58o7qermfIC

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.gizemetiket.com.tr
  • Port:
    21
  • Username:
    pgizemM6
  • Password:
    giz95Ffg

Targets

    • Target

      Orden de compra N05674.exe

    • Size

      867KB

    • MD5

      16b23de1b7e00c46c6900bee2025973f

    • SHA1

      443545677090d662e1f1b2e20bef8c0ac5110f99

    • SHA256

      190fe375bcfe2812fc4f94266fcf19b2a8527b1b7f31e63caa1a6b9c00c34c53

    • SHA512

      551923d313edf7c6822ab1f70d0cad2e7faedccc58feb3c690b620278718cdd9ea621a5ef83f34e1cc595df4d8e7751f8ae0db8adb3b6935fe7396cd8c886f80

    • SSDEEP

      12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCx/D7Hr2mIqTMB/F9ZbrD:uRmJkcoQricOIQxiZY1iaCxCrqTCNbrD

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks