Overview

overview

10

Static

static

ebuka.exe

windows7_x64

10

ebuka.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebuka.exe

  • Size

    669KB

  • Sample

    210727-h8gdpr8gg2

  • MD5

    31d7c9de4d1b739ec63418eb198e84b3

  • SHA1

    78e6aec1a778e901f289369ddfd2144fe9d595df

  • SHA256

    93709182d579b433aa5f5fe1e4eeba4de3b5e497f78a5ef34d35bcd981f49f15

  • SHA512

    ecf9b902f9e77d827fac0ed31ad8b44003e9734c83cc3ea4ae397c9526528efc9b7497564fd02a1909a57ae64d10b603d15856cfb87911cba8d7b9ab78f026f5

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.rgp.com.pk
  • Port:
    587
  • Username:
    pv@rgp.com.pk
  • Password:
    pvr999

Targets

    • Target

      ebuka.exe

    • Size

      669KB

    • MD5

      31d7c9de4d1b739ec63418eb198e84b3

    • SHA1

      78e6aec1a778e901f289369ddfd2144fe9d595df

    • SHA256

      93709182d579b433aa5f5fe1e4eeba4de3b5e497f78a5ef34d35bcd981f49f15

    • SHA512

      ecf9b902f9e77d827fac0ed31ad8b44003e9734c83cc3ea4ae397c9526528efc9b7497564fd02a1909a57ae64d10b603d15856cfb87911cba8d7b9ab78f026f5

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks