Overview

overview

10

Static

static

10

8ce4bc4bb7...4e.exe

windows7-x64

10

8ce4bc4bb7...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ce4bc4bb78159cd583879003da3b03812f41b5e1bf85c6172b0842d4e4f7e4e

  • Size

    234KB

  • Sample

    240428-bf4azsce39

  • MD5

    97584c452dcaf5db3f15d569db3a5640

  • SHA1

    0c8aa333029f47913d0e618c55eb3ce4eaa7fa0f

  • SHA256

    8ce4bc4bb78159cd583879003da3b03812f41b5e1bf85c6172b0842d4e4f7e4e

  • SHA512

    814bbb056625277826306aadbee40db2e9ae5c0b247e37b474c4f682ffc481db9045f40a32ff1fa5482512da32d18d59fbe750ff946e4a23923bc4a0af37aed4

  • SSDEEP

    3072:v8OlR1Zl0lFP4Yb28xgcic74MdanQ+x5Pq7nhq3:v8OlR1Zl0lFPTb28xgFxM0nXMnA

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.worlorderbillions.top
  • Port:
    587
  • Username:
    obinosky411@worlorderbillions.top
  • Password:
    ##z$P{dTygVX
  • Email To:
    obinosky411@worlorderbillions.top

Targets

    • Target

      8ce4bc4bb78159cd583879003da3b03812f41b5e1bf85c6172b0842d4e4f7e4e

    • Size

      234KB

    • MD5

      97584c452dcaf5db3f15d569db3a5640

    • SHA1

      0c8aa333029f47913d0e618c55eb3ce4eaa7fa0f

    • SHA256

      8ce4bc4bb78159cd583879003da3b03812f41b5e1bf85c6172b0842d4e4f7e4e

    • SHA512

      814bbb056625277826306aadbee40db2e9ae5c0b247e37b474c4f682ffc481db9045f40a32ff1fa5482512da32d18d59fbe750ff946e4a23923bc4a0af37aed4

    • SSDEEP

      3072:v8OlR1Zl0lFP4Yb28xgcic74MdanQ+x5Pq7nhq3:v8OlR1Zl0lFPTb28xgFxM0nXMnA

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks