Overview

overview

10

Static

static

remittance...20.exe

windows7_x64

10

remittance...20.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    remittance advice 7.9.20.exe

  • Size

    889KB

  • Sample

    200709-2dkxyvf23n

  • MD5

    aa54e572432813a7d322e244339aa7b6

  • SHA1

    dc66aef6d10872755dc4398c2915a5ec97054e17

  • SHA256

    cc71aaff5556a4053df2846a191ff63e54b3b10df75b98a3d8d5edc4c02c7d1b

  • SHA512

    52dbe880edb8cb74c3faef8a235d6e80947bd3ead4e3923a6577c39a467312a02ff99da95a6dafdf16d13e14b850ec1582ab9fe026658acba536f7b3e25280ab

Score
10/10
agentteslananocorekeyloggerspywarestealertrojanupx

Malware Config

Targets

    • Target

      remittance advice 7.9.20.exe

    • Size

      889KB

    • MD5

      aa54e572432813a7d322e244339aa7b6

    • SHA1

      dc66aef6d10872755dc4398c2915a5ec97054e17

    • SHA256

      cc71aaff5556a4053df2846a191ff63e54b3b10df75b98a3d8d5edc4c02c7d1b

    • SHA512

      52dbe880edb8cb74c3faef8a235d6e80947bd3ead4e3923a6577c39a467312a02ff99da95a6dafdf16d13e14b850ec1582ab9fe026658acba536f7b3e25280ab

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanupxnanocore

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • AgentTesla Payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks