Overview

overview

10

Static

static

PROJECT_.EXE

windows7_x64

10

PROJECT_.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Project Document For Batangas LNG Terminal Project, Phillippines Project_Rev A_scanned from a xerox work centre006.img

  • Size

    1.6MB

  • Sample

    200709-hgwtp8t23x

  • MD5

    7954ad220360be3b70dc7ad38a4335e4

  • SHA1

    e8bfffb91d2a09e1798842740ab606b79cdc2b29

  • SHA256

    294f80f5a42c0741826b9345ede027d42fae595fc49a69910db27e7bc2e1f555

  • SHA512

    81bfe9833f487a9a2d348f574c844aa5c9bce8af754339dd29169ea14064229eb16ef21894dddf5fc7c25a47c50be27b18bf28c8cb60af97ffcf80f2b3f4bf07

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.masterindo.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    uLrOsjJYN9

Targets

    • Target

      PROJECT_.EXE

    • Size

      1.0MB

    • MD5

      34d8364be0227837e9cd6503f426c08e

    • SHA1

      43da38e0840229b6496bff651892531c97458a38

    • SHA256

      f43b32a0a224d190f5ce2f523d8a243c1ec7e0cc16798f2eaf4e4eb22480df43

    • SHA512

      6c5865b55aa377f9eb9f8857e584c6ca7f0b5ef60984fc61789da15aa60a0bd801660790793e2da93b21b964a4f1d930c29a8eee77281cfe64d71f0e2fea3910

    Score
    10/10
    spywarekeyloggertrojanstealeragenttesla

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks