Overview

overview

10

Static

static

9

rtyuu.exe

windows7_x64

10

rtyuu.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rtyuu.exe

  • Size

    1.6MB

  • Sample

    210130-xazb42chsa

  • MD5

    d30ff9ce946801b8590e2726b8154fea

  • SHA1

    0ca3c4662dd05cee5aa1911940deebd598e10b83

  • SHA256

    bc58f1f37527b2256089b3fedbf5044ad396b267a762ca7e7f6fa7c81f76259b

  • SHA512

    7eb74a15da067728de3bec845930a3611e0e2be38ef927b896031e2f12b80c34cb1fc74b98f04af7d206a432e75ac48efc1200fbeaf7fea419bace6542e0c482

Score
10/10
agentteslahawkeyematiexkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MARYolanmauluogwo@ever

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MARYolanmauluogwo@ever

Extracted

Family

matiex

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MARYolanmauluogwo@ever

Targets

    • Target

      rtyuu.exe

    • Size

      1.6MB

    • MD5

      d30ff9ce946801b8590e2726b8154fea

    • SHA1

      0ca3c4662dd05cee5aa1911940deebd598e10b83

    • SHA256

      bc58f1f37527b2256089b3fedbf5044ad396b267a762ca7e7f6fa7c81f76259b

    • SHA512

      7eb74a15da067728de3bec845930a3611e0e2be38ef927b896031e2f12b80c34cb1fc74b98f04af7d206a432e75ac48efc1200fbeaf7fea419bace6542e0c482

    Score
    10/10
    agentteslahawkeyematiexkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Matiex

      Matiex is a keylogger and infostealer first seen in July 2020.

      stealerkeyloggermatiex

    • Matiex Main Payload

    • AgentTesla Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks