Overview

overview

10

Static

static

8

667b8ddf5a...7.xlsm

windows7_x64

10

667b8ddf5a...7.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57

  • Size

    54KB

  • Sample

    210505-w67nf57kde

  • MD5

    a423d144ec2cd23a22fc179153d06fa3

  • SHA1

    a2118deabba0a515e954c15a70cdbb5459076e4c

  • SHA256

    667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57

  • SHA512

    70ae72c4beaa0f9f667bc1da22f4070176847285ecb35527c3a3349df9aec776b88247ac0d15164f3ff188d8484f4fc15f5627256472ba7d3649a104856ce6ea

Score
10/10
agentteslakeyloggermacropersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

http://103.133.105.179/3232/inc/62120b2819c6f4.php

http://103.133.105.179/3434/inc/7b9d8501be5bee.php

Targets

    • Target

      667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57

    • Size

      54KB

    • MD5

      a423d144ec2cd23a22fc179153d06fa3

    • SHA1

      a2118deabba0a515e954c15a70cdbb5459076e4c

    • SHA256

      667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57

    • SHA512

      70ae72c4beaa0f9f667bc1da22f4070176847285ecb35527c3a3349df9aec776b88247ac0d15164f3ff188d8484f4fc15f5627256472ba7d3649a104856ce6ea

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks