Overview

overview

10

Static

static

Invoice.xls.exe

windows7_x64

10

Invoice.xls.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice.xls.exe

  • Size

    520KB

  • Sample

    200711-2bk4d21yfx

  • MD5

    02560028dfcdedc12d0935646cf8c647

  • SHA1

    086beef2db5d9d89ff0d4c54b0d8a2235ed3c30f

  • SHA256

    38aa6ce584971bec4bcc91ac05fd05ac08ad5289236c5b332a5782e83df8e578

  • SHA512

    e4791b3b296fd06ed7bb8dfb396b2edba2d1a43486c4f57c80512e29d7d30fedbb23dfb5beb93d1da095ff684eb3ed116054f40a1c60b1e5af4f792cce096003

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.rezuit.pro
  • Port:
    587
  • Username:
    humbato01@rezuit.pro
  • Password:
    chukwuma22

Targets

    • Target

      Invoice.xls.exe

    • Size

      520KB

    • MD5

      02560028dfcdedc12d0935646cf8c647

    • SHA1

      086beef2db5d9d89ff0d4c54b0d8a2235ed3c30f

    • SHA256

      38aa6ce584971bec4bcc91ac05fd05ac08ad5289236c5b332a5782e83df8e578

    • SHA512

      e4791b3b296fd06ed7bb8dfb396b2edba2d1a43486c4f57c80512e29d7d30fedbb23dfb5beb93d1da095ff684eb3ed116054f40a1c60b1e5af4f792cce096003

    Score
    10/10
    spywarekeyloggertrojanstealeragenttesla

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks