Overview

overview

10

Static

static

80e4387f16...46.exe

windows7_x64

10

80e4387f16...46.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80e4387f16af71a0e195b660788e7a46

  • Size

    754KB

  • Sample

    210726-dthl22f6za

  • MD5

    80e4387f16af71a0e195b660788e7a46

  • SHA1

    28d031ced02385ce7a5c817a6df5d6352e70d90f

  • SHA256

    addcf96b8f245d197cc999bef98684c34c168f247b77f09de3b0be50200b553c

  • SHA512

    1d9a4ebe30e0c2c20e057071d6b000160fd89e45139bbd7f8015971f833b5a48bca39731bbb3dfa2223a4f80e0b99679cc991b5edfcba62d2b29b0060571baef

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    cjnew@cjserverlogs2021luck.xyz
  • Password:
    cjcurrent@5000

Targets

    • Target

      80e4387f16af71a0e195b660788e7a46

    • Size

      754KB

    • MD5

      80e4387f16af71a0e195b660788e7a46

    • SHA1

      28d031ced02385ce7a5c817a6df5d6352e70d90f

    • SHA256

      addcf96b8f245d197cc999bef98684c34c168f247b77f09de3b0be50200b553c

    • SHA512

      1d9a4ebe30e0c2c20e057071d6b000160fd89e45139bbd7f8015971f833b5a48bca39731bbb3dfa2223a4f80e0b99679cc991b5edfcba62d2b29b0060571baef

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks