Overview

overview

10

Static

static

PO-K-128 I...54.exe

windows7_x64

10

PO-K-128 I...54.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    PO-K-128 IAN 340854.exe
  • Size 852KB
  • Sample210802-sb1x2fd75s
  • SHA256 f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff
  • MD5 SHA1 SHA512
Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials
  • Protocol

    smtp
  • Host

    mail.odessabd.com
  • Port

    587
  • Username

    [email protected]
  • Password

    abc321

Targets

    • Target
      PO-K-128 IAN 340854.exe
    • Size 852KB
    • SHA256 f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff
    • MD5 SHA1 SHA512
    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks