Overview

overview

10

Static

static

Ningbo shi...21.exe

windows7_x64

10

Ningbo shi...21.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ningbo shipping statement for March 2021.exe

  • Size

    816KB

  • Sample

    210419-7trfvs9q7j

  • MD5

    840a47d9bf5168dd2f452b86294bc9da

  • SHA1

    36814de1a82ae89739b26b0edb90abf41ca867cb

  • SHA256

    b28f9a7f96b064ebc4ea9076e9dbaabce7387ef2a38944fcab534dc65e88d050

  • SHA512

    bb54779bcfbfe88de1bcc6e4407087184c8910462f808275c2c46ef8350b60d437ef9fafec574317c40590af7c81d2e96f823a9d48aa17b7b964eae82b6767a0

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    webmail.mdist.us
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pos#4321

Targets

    • Target

      Ningbo shipping statement for March 2021.exe

    • Size

      816KB

    • MD5

      840a47d9bf5168dd2f452b86294bc9da

    • SHA1

      36814de1a82ae89739b26b0edb90abf41ca867cb

    • SHA256

      b28f9a7f96b064ebc4ea9076e9dbaabce7387ef2a38944fcab534dc65e88d050

    • SHA512

      bb54779bcfbfe88de1bcc6e4407087184c8910462f808275c2c46ef8350b60d437ef9fafec574317c40590af7c81d2e96f823a9d48aa17b7b964eae82b6767a0

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks