Overview

overview

10

Static

static

required.exe

windows7_x64

10

required.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    COSCO SHIPPING AGENCY.rar

  • Size

    520KB

  • Sample

    210915-hnm3asaac5

  • MD5

    8780698494c447a5b1837b7256adc8b8

  • SHA1

    862dab75929a91f8f22025b9ca195d58df5e0af6

  • SHA256

    3711fe2e62b7f27e9c09c78aeff22d72ef951626fd342b4c0571720cb0deb692

  • SHA512

    544c71b230a9d38e7eb66054c9bfe3bbc730f93aa714c686b8eaa1e5dab87950c07ddddbb36c99c72b20a916a625041fa33cc9ef70b1ac128c3ab3e5d2511022

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.rosaritoindustries.com
  • Port:
    587
  • Username:
    inquiry@rosaritoindustries.com
  • Password:
    aircondivision2019

Targets

    • Target

      required.exe

    • Size

      1.0MB

    • MD5

      08a652c3adb52cc860c1b35dc2838f23

    • SHA1

      6d630ca20b831dfa6db2b33ea1f0a256a1d13e60

    • SHA256

      63e6198cee195250e7ef3aedecfacdfeb6fdbce9e4f3fd9c1260ef67075819a3

    • SHA512

      7df0d8df46a9b44652a239c969f2da6bc81f15b91cc6ecfef9b904caf27dc73fa37494113651931f5c866e1f8b42503279addb0d209997a13cd646421d198c5f

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks