Overview

overview

10

Static

static

qmfXCa40rlkrbw8.exe

windows7_x64

10

qmfXCa40rlkrbw8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    qmfXCa40rlkrbw8.exe

  • Size

    1009KB

  • Sample

    210915-hh37bsaaa9

  • MD5

    0f9c4f6cf696c0b5077579c144f04c4b

  • SHA1

    df536c232366604e3258d1b0b4ce30732047d0a4

  • SHA256

    d63716278fd0c99651d478478ac8951c5a17b632072afb5fe9dd6c6d4f43c911

  • SHA512

    157d96457be90d25ea74cd14dbb19a2da7efb46196f2a886ac39531ed8bd7bb1c9d0952e0908fdf7cece3e6c2717ea3c6a94ce56ea61ab402c15a5c488a49602

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1840149904:AAF9D1mm8ZITxzSWfLFbRBfwFML1TyPoOMk/sendDocument

Targets

    • Target

      qmfXCa40rlkrbw8.exe

    • Size

      1009KB

    • MD5

      0f9c4f6cf696c0b5077579c144f04c4b

    • SHA1

      df536c232366604e3258d1b0b4ce30732047d0a4

    • SHA256

      d63716278fd0c99651d478478ac8951c5a17b632072afb5fe9dd6c6d4f43c911

    • SHA512

      157d96457be90d25ea74cd14dbb19a2da7efb46196f2a886ac39531ed8bd7bb1c9d0952e0908fdf7cece3e6c2717ea3c6a94ce56ea61ab402c15a5c488a49602

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks