Overview

overview

10

Static

static

7

2f4f19dbfa...cs.exe

windows7-x64

10

2f4f19dbfa...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f4f19dbfa8271825a56f509f89769a007fb382a72b23b1cc4d57ce8148f1d16_NeikiAnalytics.exe

  • Size

    583KB

  • Sample

    240701-c5sffsxbnr

  • MD5

    3bb08ad23a8e347f28f8c0b9a26d4af0

  • SHA1

    619723fafc56d38b67a94b4278692fa2dfc2deda

  • SHA256

    2f4f19dbfa8271825a56f509f89769a007fb382a72b23b1cc4d57ce8148f1d16

  • SHA512

    286915c68eb5387a2f988beec7d17f2b087296a6562512ffe70e5dc86f8f530db3bd588ba9d9e0f5b2269afe839311dcfe8da644e495f6dc1eb6d93332e672ac

  • SSDEEP

    12288:qYV6MorX7qzuC3QHO9FQVHPF51jgcd20mS+lX1qroxNEyu:ZBXu9HGaVHXm1XErox6D

Score
10/10
agentteslakeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      2f4f19dbfa8271825a56f509f89769a007fb382a72b23b1cc4d57ce8148f1d16_NeikiAnalytics.exe

    • Size

      583KB

    • MD5

      3bb08ad23a8e347f28f8c0b9a26d4af0

    • SHA1

      619723fafc56d38b67a94b4278692fa2dfc2deda

    • SHA256

      2f4f19dbfa8271825a56f509f89769a007fb382a72b23b1cc4d57ce8148f1d16

    • SHA512

      286915c68eb5387a2f988beec7d17f2b087296a6562512ffe70e5dc86f8f530db3bd588ba9d9e0f5b2269afe839311dcfe8da644e495f6dc1eb6d93332e672ac

    • SSDEEP

      12288:qYV6MorX7qzuC3QHO9FQVHPF51jgcd20mS+lX1qroxNEyu:ZBXu9HGaVHXm1XErox6D

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanupx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks