Overview

overview

10

Static

static

5

quotation_830001.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b16e0472-db88-751d-a620-1168d20de8ca.eml

  • Size

    763KB

  • Sample

    250401-s43g2atny2

  • MD5

    b1140d57e9e952feac9731920d082ec2

  • SHA1

    5aebeafc78f64b2fe2e0528156ef06938b360ff3

  • SHA256

    fbc1058beb1fbdb8f879df45a41c1edda3afed837a57f98f7b6f30d25c6f81e5

  • SHA512

    91660400e4669dd32191025b1fda13b6e45470b2226f817ba7143d7e06283dd8a32f70f7b39c603fe8337de28e696dbf9509569121f7a9f5dc15041cddbdc87f

  • SSDEEP

    12288:lvYloUTUFHtn6lOmbjZRu/5yYWZAREjiGf8QKkQmPF39yN7JUJeB5Unm:lveoSU1FeZpYuASGIPQmPr47WW5em

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      quotation_830001.exe

    • Size

      1.0MB

    • MD5

      fa0436e4d257b7194ffadc938906cf15

    • SHA1

      e9292e8dd3e49c1f40bf8587789cba3b9a38e2b5

    • SHA256

      b5e2de824cc74a610b40a19cdda13bfb79e21b83745aaa2d85b5efea027cc730

    • SHA512

      6b080111b3d11f090723b7c39118b08413e31b2abbe4c636328e64870512b241d34f7fd658e5311accabfd1d0004d80fb37eb8a0f6326d80a7bbe5ddd0058647

    • SSDEEP

      24576:Gu6J33O0c+JY5UZ+XC0kGso6FafxBGZkKmij1UlZ+WY:Iu0c++OCvkGs9FafxBqkxh7Y

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks