Overview

overview

10

Static

static

Invoice#P....6.xlsx

windows7_x64

10

Invoice#P....6.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice#P.O474746.xlsx

  • Size

    602KB

  • Sample

    210728-dxftjy45cn

  • MD5

    80126b0c7190360c63cdfc0b57839920

  • SHA1

    191ffb490653ca129ed7fe603f2d7734d3d0c157

  • SHA256

    dae10b4be19f81707d8c9b2fab7539a0f5a9c82ef37f5c0ee3500c161c68fb20

  • SHA512

    6ccb4cf91abfa2693b79099d9e498aa24658fb1a5c6f85420487fa8998208fc6ac9caf4ca1053179e0c331cabaf411607a8e0344654c920f67d991b0a6fa0979

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.simpleitalian.com.au
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    SIpassword101$

Targets

    • Target

      Invoice#P.O474746.xlsx

    • Size

      602KB

    • MD5

      80126b0c7190360c63cdfc0b57839920

    • SHA1

      191ffb490653ca129ed7fe603f2d7734d3d0c157

    • SHA256

      dae10b4be19f81707d8c9b2fab7539a0f5a9c82ef37f5c0ee3500c161c68fb20

    • SHA512

      6ccb4cf91abfa2693b79099d9e498aa24658fb1a5c6f85420487fa8998208fc6ac9caf4ca1053179e0c331cabaf411607a8e0344654c920f67d991b0a6fa0979

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks