Overview

overview

10

Static

static

PO #-NHU.exe

windows7_x64

10

PO #-NHU.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO #-NHU.exe

  • Size

    491KB

  • Sample

    201109-x8w7vgch1s

  • MD5

    53aecf8da936ceeee03466ea0b23a355

  • SHA1

    edb66f141e0ca7fc40c69970f84b9288ad5daf2b

  • SHA256

    d7cbce19566617353e8ab7c32adcee2543a7e9422ac77b6ef8b3b64b58389651

  • SHA512

    3cd5fb16e2aa8a00ded82f91059328cea925f52d4c2983a0298d102e92d72904283fae07e77acc7eea8af87f24b168ffc05596dd432a65aad579c5b62c48fde7

Score
10/10
agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.dianaglobalmandiri.com
  • Port:
    587
  • Username:
    info@dianaglobalmandiri.com
  • Password:
    Batam2019

Targets

    • Target

      PO #-NHU.exe

    • Size

      491KB

    • MD5

      53aecf8da936ceeee03466ea0b23a355

    • SHA1

      edb66f141e0ca7fc40c69970f84b9288ad5daf2b

    • SHA256

      d7cbce19566617353e8ab7c32adcee2543a7e9422ac77b6ef8b3b64b58389651

    • SHA512

      3cd5fb16e2aa8a00ded82f91059328cea925f52d4c2983a0298d102e92d72904283fae07e77acc7eea8af87f24b168ffc05596dd432a65aad579c5b62c48fde7

    Score
    10/10
    agentteslacoreentityevasionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks