Overview

overview

10

Static

static

5

OC C6 2400116.exe

windows7-x64

10

OC C6 2400116.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28012025_0011_27012025_OC C6 2400116.7Z

  • Size

    520KB

  • Sample

    250128-ag2ccazqbv

  • MD5

    a23b4013b44e402d04dcd472fbe425ec

  • SHA1

    7a4e3241cf0fcd3897f9c0dbe76e5ad249ad6ccc

  • SHA256

    d49fe628398ef3093e4641252aa87275e66e6f53496294b31e7c9f7f0c24a6c9

  • SHA512

    be05509512dda98f2ca3aa0c1d62c0661e378e83cfaab791d4945cee52b0f8767cc7fb5f2deefcb209d799b22417660a1e0d5e03f11a559f94a65e7afb607e34

  • SSDEEP

    12288:gYLhrMHOc052GzLBCewDyw2PbkIBkYkVhZYsoNZo+5XqczF:DS22GzLgewDyw2PbkizuhCnZraczF

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      OC C6 2400116.exe

    • Size

      935KB

    • MD5

      a1fde113a1cc308535ac79c7bc7c8290

    • SHA1

      695ae6590d774693f233e85ffc5987a14af45922

    • SHA256

      765ace8a65fcb85916ba933317a10f3814d54c94e93c9a36334c6f7f21c0485b

    • SHA512

      6f1f7955b162e9f0af1327a0754aa6c5ed7e1d126e221221a03117629deebd2634e2fc319bf54c83f8ab801218d306f737a65e4a526fbf436b46e60cccf5e3b2

    • SSDEEP

      24576:IRmJkcoQricOIQxiZY1ianqPlJPXYHhGq8+L4:tJZoQrbTFZY1iaqPlJQHkqlM

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks