Overview

overview

10

Static

static

Default

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DEBIT NOTE pdf.r09

  • Size

    439KB

  • Sample

    210128-1bvbe4n7zn

  • MD5

    cd079dcc31de98f0bf79aedac5e3daa7

  • SHA1

    7f9242511600b4716bdd7401a854191358b8f74e

  • SHA256

    66be221ac6a91479fd4fb03076fd068f221987bc1c65152aaab962e357c693fb

  • SHA512

    f8b3258e26da7b70fcfc7bbd06c286cfb16d852900e97d0e436f15c5f82599439cb6761a05a93e6d4a27a680118db12115fde8dd8918cf33dc3e9cd7d853229e

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    12345@cashmonni

Targets

    • Target

      DEBIT NOTE pdf.exe

    • Size

      807KB

    • MD5

      f72a19d87bddd526b0849aecc678cae9

    • SHA1

      535ab2a42adcc5b304d7f97ad65291842750695d

    • SHA256

      7b8b01a5231f1cd79b7497c634aa4e315d5673c3a2809ba0e4366f57efc2bf28

    • SHA512

      c5986f726ae50a5c75213be27b1131a78025e39e8db5ef9045ee56bcf905e171ea9c516e32b22341ef593ed12bf873a0f7e33acb4f712827a1e8db21cbea56fd

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks