Overview

overview

10

Static

static

PL5CS6pwNitND2n.exe

windows7_x64

10

PL5CS6pwNitND2n.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PL5CS6pwNitND2n.exe

  • Size

    559KB

  • Sample

    210126-196vjmeq3s

  • MD5

    2370f590e857316425728c92f69e87ef

  • SHA1

    318a4f4263e9c9a4dbee501d75649aeb6fafc62d

  • SHA256

    b0512bf4c4bebccd0be10d2f25cf41a31b76ad4d282e0f3fa53799d45e906a15

  • SHA512

    e37f0ba55815c646796cd863921f884e7099b20f53b1c9eaebb22e247a0b28a6a67e05b2f35ce618d5451e556e8a6021cb7ea71bfc832c415480f3fc59f8ab35

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.lockitsolutions.co.ke
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7p4m*_^m)PXc

Targets

    • Target

      PL5CS6pwNitND2n.exe

    • Size

      559KB

    • MD5

      2370f590e857316425728c92f69e87ef

    • SHA1

      318a4f4263e9c9a4dbee501d75649aeb6fafc62d

    • SHA256

      b0512bf4c4bebccd0be10d2f25cf41a31b76ad4d282e0f3fa53799d45e906a15

    • SHA512

      e37f0ba55815c646796cd863921f884e7099b20f53b1c9eaebb22e247a0b28a6a67e05b2f35ce618d5451e556e8a6021cb7ea71bfc832c415480f3fc59f8ab35

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks