Overview

overview

10

Static

static

5

OC GDL48940.exe

windows7-x64

10

OC GDL48940.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OC GDL48940.exe

  • Size

    1.2MB

  • Sample

    250128-npe1zazpgl

  • MD5

    bc4193c8697c930516e7f8a0b455efd4

  • SHA1

    8c949a64324491d76e0ff216dda5864d4fda874d

  • SHA256

    5420f805940014cf9e51372725194209e75017aaa65c73673ceab6751784fe1d

  • SHA512

    90d79ee2ce69c3cafb13bc319abe940267a3f5bb5c096bb16cce8b9a4cdc0e6c7fa2a347ee5b6608589fb9ee8c2c973f596bf520b88df0dd39fbb8088fb952f0

  • SSDEEP

    24576:IRmJkcoQricOIQxiZY1ia/FyzVpd944CPkjgdlMMpFV:tJZoQrbTFZY1ia/F2/Br8lMMFV

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      OC GDL48940.exe

    • Size

      1.2MB

    • MD5

      bc4193c8697c930516e7f8a0b455efd4

    • SHA1

      8c949a64324491d76e0ff216dda5864d4fda874d

    • SHA256

      5420f805940014cf9e51372725194209e75017aaa65c73673ceab6751784fe1d

    • SHA512

      90d79ee2ce69c3cafb13bc319abe940267a3f5bb5c096bb16cce8b9a4cdc0e6c7fa2a347ee5b6608589fb9ee8c2c973f596bf520b88df0dd39fbb8088fb952f0

    • SSDEEP

      24576:IRmJkcoQricOIQxiZY1ia/FyzVpd944CPkjgdlMMpFV:tJZoQrbTFZY1ia/F2/Br8lMMFV

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks