Overview

overview

10

Static

static

opo (1).exe

windows7_x64

10

opo (1).exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    opo (1).exe

  • Size

    500KB

  • Sample

    201109-1ed8ncwlyx

  • MD5

    6f366f6932afabce27a09613f221fe7d

  • SHA1

    4795261b97ca244bef5a007e2bcce74350a091eb

  • SHA256

    f35fa2a6281a2a24016729d315083a638edf176a890a605dba2ac134e1733bb3

  • SHA512

    8d063bb927760a9b3ad435162b3b97f0ccd824e6aaa96e97baa71460b29ae12388399138a0862e79d5754f1056e2e8ee5cd09ec91d02fdc3ee8578ca089ac651

Score
10/10
agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.cpworldindia.com
  • Port:
    587
  • Username:
    parag.bapodara@ahd.cpworldindia.com
  • Password:
    bopo@2014

Targets

    • Target

      opo (1).exe

    • Size

      500KB

    • MD5

      6f366f6932afabce27a09613f221fe7d

    • SHA1

      4795261b97ca244bef5a007e2bcce74350a091eb

    • SHA256

      f35fa2a6281a2a24016729d315083a638edf176a890a605dba2ac134e1733bb3

    • SHA512

      8d063bb927760a9b3ad435162b3b97f0ccd824e6aaa96e97baa71460b29ae12388399138a0862e79d5754f1056e2e8ee5cd09ec91d02fdc3ee8578ca089ac651

    Score
    10/10
    agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks