Overview

overview

10

Static

static

dasd1q3.exe

windows7_x64

10

dasd1q3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample-327148-ec9d8ae5e3f1edb4cb960890df58a50f.zip

  • Size

    826KB

  • Sample

    201205-fggl579pdx

  • MD5

    4ebc86a0acc03a67f72a23d6f9e747de

  • SHA1

    47eb5905b71fde4f6eb162f80310eacbee363a4a

  • SHA256

    bfe7be1471b27d0f95cef7fffc805f3fbaab298de03e81d4ba447fa3554801a3

  • SHA512

    8cc34bc6259463164fb329624b9308bc6733f45b645b43eb6a82c03c96096e0bae662c69846e6313b40240dc626d63ed0f914ddfaac8bc0a6f17770627674be8

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.greatgoldenqlory.com
  • Port:
    587
  • Username:
    kingman@greatgoldenqlory.com
  • Password:
    chibuike12345@@@@@

Targets

    • Target

      dasd1q3.exe

    • Size

      953KB

    • MD5

      ec9d8ae5e3f1edb4cb960890df58a50f

    • SHA1

      d1b0064278538dc3cbea88d9f8d783fa88644a8f

    • SHA256

      3895763b841c38a584cbf2f0154d3c26b08855fdb0ae2c1cdf3ced800bff09bc

    • SHA512

      7fa894dbf90937b5624fe284fbabd181f7fc429bcb3362c9182bafb320476f1b526849258748ec56f009dcdbb6ff45cc936e45f4c1aa518ad0551cd7406714ab

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks