Overview

overview

10

Static

static

Ningbo_Out...ts.exe

windows7_x64

10

Ningbo_Out...ts.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ningbo_Outstanding_Payments.exe

  • Size

    1.2MB

  • Sample

    210416-q3yqcdyzfs

  • MD5

    fa7f7b4b92e71a14bd56f292ab142c89

  • SHA1

    9804cd46c5bd25e805865f83006bb42c01c6fd2f

  • SHA256

    0e8f5b7bb9a8fb551c67b15bd74cf530324e939b8acd491fac54a7a64a51b568

  • SHA512

    d0bafb20dad0376cb5f417d6ac8e56bf613b3084f4b216b4e10b87cbecd40f06eddd665a9abbb2736085f316906ba73b0591a268aafd4dd62645ec3b943b1511

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    webmail.mdist.us
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pos#4321

Targets

    • Target

      Ningbo_Outstanding_Payments.exe

    • Size

      1.2MB

    • MD5

      fa7f7b4b92e71a14bd56f292ab142c89

    • SHA1

      9804cd46c5bd25e805865f83006bb42c01c6fd2f

    • SHA256

      0e8f5b7bb9a8fb551c67b15bd74cf530324e939b8acd491fac54a7a64a51b568

    • SHA512

      d0bafb20dad0376cb5f417d6ac8e56bf613b3084f4b216b4e10b87cbecd40f06eddd665a9abbb2736085f316906ba73b0591a268aafd4dd62645ec3b943b1511

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks