Overview

overview

10

Static

static

FDA.exe

windows7_x64

10

FDA.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FDA.rar

  • Size

    551KB

  • Sample

    210915-g52rcahhh3

  • MD5

    3695e7eeca88b9a0e16351116eaf01b7

  • SHA1

    b622030c36ce8bd32f42a805c2a26d4862571011

  • SHA256

    02d0286cf02f434949e434e6a5d293f11d80991f35bf5650c444660382c1b3a1

  • SHA512

    d38397a7a1aba224f2e7ae6340c4f5a02b761ba8dfd6c151d48889c93fd184317a2c607328a43af61a9fff96488e14f6ce4bb1a8dca64313696664e6c4f5c5b5

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.rosaritoindustries.com
  • Port:
    587
  • Username:
    inquiry@rosaritoindustries.com
  • Password:
    aircondivision2019

Targets

    • Target

      FDA.exe

    • Size

      1.0MB

    • MD5

      08a652c3adb52cc860c1b35dc2838f23

    • SHA1

      6d630ca20b831dfa6db2b33ea1f0a256a1d13e60

    • SHA256

      63e6198cee195250e7ef3aedecfacdfeb6fdbce9e4f3fd9c1260ef67075819a3

    • SHA512

      7df0d8df46a9b44652a239c969f2da6bc81f15b91cc6ecfef9b904caf27dc73fa37494113651931f5c866e1f8b42503279addb0d209997a13cd646421d198c5f

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks