Overview

overview

10

Static

static

Order_8383...df.exe

windows7_x64

10

Order_8383...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order_8383747_list.pdf.exe

  • Size

    494KB

  • Sample

    201109-lh64xcmwsx

  • MD5

    e06836b92d0549a209b5fdc76478ed5e

  • SHA1

    fd399b3d85388b44a9e7ab21eb0131f0498364bb

  • SHA256

    67819aacac4994b55659a8f7924ec0384e667ee74fe5b431a731ac5baf69448c

  • SHA512

    292802a00030afc4c2151b527c73aca7a4574678b87713ce981aeca10562e5546318d8fd373bdc6f3741a1c12d6be2dfef28699aa5eae911a1f37cd2e8454e1d

Score
10/10
agentteslacoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    premium57.web-hosting.com
  • Port:
    587
  • Username:
    support@zoomexpress.online
  • Password:
    Goodboy123??

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    premium57.web-hosting.com
  • Port:
    587
  • Username:
    support@zoomexpress.online
  • Password:
    Goodboy123??

Targets

    • Target

      Order_8383747_list.pdf.exe

    • Size

      494KB

    • MD5

      e06836b92d0549a209b5fdc76478ed5e

    • SHA1

      fd399b3d85388b44a9e7ab21eb0131f0498364bb

    • SHA256

      67819aacac4994b55659a8f7924ec0384e667ee74fe5b431a731ac5baf69448c

    • SHA512

      292802a00030afc4c2151b527c73aca7a4574678b87713ce981aeca10562e5546318d8fd373bdc6f3741a1c12d6be2dfef28699aa5eae911a1f37cd2e8454e1d

    Score
    10/10
    agentteslacoreentitykeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks