Overview

overview

10

Static

static

5

Shippin Do...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Shippin Documents_Original BL_Invoice_Packaging List.pdf.ace

  • Size

    527KB

  • Sample

    250402-lkrsvst1dy

  • MD5

    393e4c3fb6149bd2f4e2a5a22a39f72d

  • SHA1

    acac38892ae58d1785175bd910602d819a7dbad7

  • SHA256

    9929bcac4461556bebac82a1d8ba6e2bb060e060e6046f3e2137c391ff2c9722

  • SHA512

    3451f6e88ba86333554a976d1b52408e652c186178260fd0d9a44b6783758b34c3c0d664d67a059b057183f5062b17b6f766c07a672d25325330c4e2fdd182e9

  • SSDEEP

    12288:G7UsLhj4llsQfHaVxHkd5I2wMC3rOUUqvvPncBgg9YVtr0pCr/3:G7UW4HdaArjC3KUUKncB3Yzr0pC

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.wapination.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    sync@#1235

Targets

    • Target

      Shippin Documents_Original BL_Invoice_Packaging List.pdf.exe

    • Size

      1014KB

    • MD5

      2e3fd6275c8a331ef93ff197ea13ed51

    • SHA1

      94aa8a3a6845822529e3c179abcf0bb8be3da2ba

    • SHA256

      c1d6dd78fed2d99fb6a9c7af0e65adee429118ec7bddbe2782cfd900003a3bce

    • SHA512

      2575e4bd75e7bf572970fd373312733b6fe6dd1bf99fbaaa70cde7044ea524f8a9ecce86bed754928a051de2f71da69b955b0b516916eb90579efe99c7d5eb23

    • SSDEEP

      24576:Tu6J33O0c+JY5UZ+XC0kGso6FaP107mvxyUWY:9u0c++OCvkGs9FaP10GCY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Drops startup file

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks