Overview

overview

10

Static

static

Ningbo_Past Due.exe

windows7_x64

10

Ningbo_Past Due.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ningbo_Past Due.exe

  • Size

    1.4MB

  • Sample

    210423-v53l1qr89s

  • MD5

    bdbcd55b9e36b751aa5e5252f0ce63bf

  • SHA1

    43f00d3645f6e964064693b129bb34dc4c540d56

  • SHA256

    f7f16e3f986d079a1cea095ae0b8c8924e3bd0d275bfece8ed8f396db100821b

  • SHA512

    78660e6b52514f6be39b81c17542284cfb82cb785ca832e96b1aebc5b9c2bd7b8df5ff25473229b61febdc62474170b5e21e0ff55de9bf74b7765cbc03ee2c9b

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    webmail.mdist.us
  • Port:
    587
  • Username:
    pos@mdist.us
  • Password:
    pos#4321

Targets

    • Target

      Ningbo_Past Due.exe

    • Size

      1.4MB

    • MD5

      bdbcd55b9e36b751aa5e5252f0ce63bf

    • SHA1

      43f00d3645f6e964064693b129bb34dc4c540d56

    • SHA256

      f7f16e3f986d079a1cea095ae0b8c8924e3bd0d275bfece8ed8f396db100821b

    • SHA512

      78660e6b52514f6be39b81c17542284cfb82cb785ca832e96b1aebc5b9c2bd7b8df5ff25473229b61febdc62474170b5e21e0ff55de9bf74b7765cbc03ee2c9b

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks