Overview

overview

10

Static

static

Purchase_I...df.exe

windows7_x64

10

Purchase_I...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase_Inquiry_pdf.exe

  • Size

    552KB

  • Sample

    210915-hzdm1aaag2

  • MD5

    5fc50cecdc7da2761f4ccce4b2c1362f

  • SHA1

    536420b712568d288112f7f38c4e79792be0c107

  • SHA256

    107c8bfec5d8a4e23c429692da4204025bb77fe71ff6b56a6804f5f19dc820c1

  • SHA512

    d0e3660d667eeeb800d305516be5fab496e9ea8aaccb271867c4de41a74298b2031424dbc5aca211aa4f30f9e739923dfa9cd124ea8392f174588d6358aefce0

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

http://bot.statusupdate.one/webpanel-charles/mawa/e22cc3544e8953ec6191.php

Targets

    • Target

      Purchase_Inquiry_pdf.exe

    • Size

      552KB

    • MD5

      5fc50cecdc7da2761f4ccce4b2c1362f

    • SHA1

      536420b712568d288112f7f38c4e79792be0c107

    • SHA256

      107c8bfec5d8a4e23c429692da4204025bb77fe71ff6b56a6804f5f19dc820c1

    • SHA512

      d0e3660d667eeeb800d305516be5fab496e9ea8aaccb271867c4de41a74298b2031424dbc5aca211aa4f30f9e739923dfa9cd124ea8392f174588d6358aefce0

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks