Overview

overview

10

Static

static

payment in...on.exe

windows7_x64

10

payment in...on.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment infirmation.exe

  • Size

    1.3MB

  • Sample

    210120-yfq2qr1t5a

  • MD5

    320eb3a29a367a0d6935df771ce086d7

  • SHA1

    14ca1d8dbf23998b2a63be591208c147caac8e6a

  • SHA256

    6661acf762423f3241fa87250e9e8e82b270ed2c8ee891f5ca64e62c0140e6b8

  • SHA512

    b7ac766aad4c101e1ce2868f13c62252910daa63926fb2b7937d4e80aee920e4ca1a1f3cc58a255760368ef9ff124c8ee9665ea01596a56897241664135c0389

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.jkudyog.com
  • Port:
    587
  • Username:
    ashutosh@jkudyog.com
  • Password:
    %$#@lkjhgfdsa

Targets

    • Target

      payment infirmation.exe

    • Size

      1.3MB

    • MD5

      320eb3a29a367a0d6935df771ce086d7

    • SHA1

      14ca1d8dbf23998b2a63be591208c147caac8e6a

    • SHA256

      6661acf762423f3241fa87250e9e8e82b270ed2c8ee891f5ca64e62c0140e6b8

    • SHA512

      b7ac766aad4c101e1ce2868f13c62252910daa63926fb2b7937d4e80aee920e4ca1a1f3cc58a255760368ef9ff124c8ee9665ea01596a56897241664135c0389

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks