Overview

overview

10

Static

static

5

facturas v...33.exe

windows7-x64

10

facturas v...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    facturasvencidas0098009900976009668009678005632598433.bz2

  • Size

    570KB

  • Sample

    250303-rsndaszxbs

  • MD5

    63cd3c8b606d289f79da5a637577c291

  • SHA1

    dfd601bd5779fd00fa2873d93aa93a43f71ce090

  • SHA256

    4642c2b3f86b4eb22b82f44e59fd33899d9d6041850acb2989e6bdb38578d28d

  • SHA512

    8de7a7c6605f27e292a7eaad2b03f13f7843a019f24182ed798d47617561107e274ba888d0af49900970b9004ad9b9223de2e84f7477bb69e1798fc4256f4d4d

  • SSDEEP

    12288:qmSnTrkrpdKLQ4SWZn5EtGIcQPqFnwvhKI4OSupoKlaFKN84n:q9WKE4vZn5EtGIfPgw5KIbSupo6zy0

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      facturas vencidas, 0098, 0099, 00976, 009668, 009678, 005632598433.exe

    • Size

      65.0MB

    • MD5

      9884d52feadfb4eb4762e3b284cdcfe2

    • SHA1

      deb3d0c34c146fad306872ad632f11a585a8c87c

    • SHA256

      7560c8343548f3dfce39d869ace7c63a4512c31f8c55429cc3100edb23b6de60

    • SHA512

      779e8a1bec91a559a482a0276d5ee243a686cbf1f8fb31a2662e2881b3b0a920284aad230ee1049250512ab003a61575237189920985ead102eeda9e96eba402

    • SSDEEP

      24576:iu6J33O0c+JY5UZ+XC0kGso6FafXpYegmm5gBoXWY:Eu0c++OCvkGs9FafZdw5gB7Y

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks