Overview

overview

10

Static

static

nd.exe

windows7_x64

10

nd.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nd.exe

  • Size

    675KB

  • Sample

    210727-p5da2ak5fx

  • MD5

    8db61814f5bb74628dc686b25abc4405

  • SHA1

    2c200f12ff8db7459ad09e0c437dbacb9d69e860

  • SHA256

    6529564e7548962df1cc1c3ae72b01ab48d83df3e00f7278743788bffd05cb2f

  • SHA512

    0858691cb55160334529976ed400b62ff5217adeb912d2d85d0ca51b166dabb2a14679217c30c7271cca97ed49fdcbd999115086ab8f194eeb90364a0e71a9b9

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp3.ines.ro
  • Port:
    587
  • Username:
    vanzari@gerocossen.ro
  • Password:
    GW!g&95W7rs

Targets

    • Target

      nd.exe

    • Size

      675KB

    • MD5

      8db61814f5bb74628dc686b25abc4405

    • SHA1

      2c200f12ff8db7459ad09e0c437dbacb9d69e860

    • SHA256

      6529564e7548962df1cc1c3ae72b01ab48d83df3e00f7278743788bffd05cb2f

    • SHA512

      0858691cb55160334529976ed400b62ff5217adeb912d2d85d0ca51b166dabb2a14679217c30c7271cca97ed49fdcbd999115086ab8f194eeb90364a0e71a9b9

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks