Overview

overview

10

Static

static

Order Requ...df.exe

windows7_x64

10

Order Requ...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order Request .pdf.exe

  • Size

    677KB

  • Sample

    210504-pt927drn16

  • MD5

    2ad72a3933556e1d30a06ae454a17d54

  • SHA1

    0e175a0e16cbd071c5d84bbef369586c49b67446

  • SHA256

    17d2636add9f6f880c490347fbd54ed7f054eb37954eadcd04992efdb81d9204

  • SHA512

    94472bb40426db8dbd8d0474a3d7386e2784b95d98c551252b7b3a5862a67bb50e5ca037b0d175ec80cb62e3ebf5fa68a7acd695a44960953b5078a07842c021

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.abanit.net
  • Port:
    587
  • Username:
    sumon@abanit.net
  • Password:
    WICUcoF4

Targets

    • Target

      Order Request .pdf.exe

    • Size

      677KB

    • MD5

      2ad72a3933556e1d30a06ae454a17d54

    • SHA1

      0e175a0e16cbd071c5d84bbef369586c49b67446

    • SHA256

      17d2636add9f6f880c490347fbd54ed7f054eb37954eadcd04992efdb81d9204

    • SHA512

      94472bb40426db8dbd8d0474a3d7386e2784b95d98c551252b7b3a5862a67bb50e5ca037b0d175ec80cb62e3ebf5fa68a7acd695a44960953b5078a07842c021

    Score
    10/10
    agentteslakeyloggerspywarestealertrojanpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks