Overview

overview

10

Static

static

Nuevo orde...at.exe

windows7_x64

10

Nuevo orde...at.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nuevo orden002______________________________________________.bat

  • Size

    84.0MB

  • Sample

    211017-3z5rpschg7

  • MD5

    c4deb0e775ada24710322868786c06ea

  • SHA1

    a0b9f4806ad995bfc7a91fc55f6b1d13ca39f359

  • SHA256

    73a61a3210194826bff95994b29f43e906b2304ebd181371db8025785612ca3e

  • SHA512

    37277ebb1918a5924ad5cc98f063348381ec0f227c73cf3fb75e12a044608f104bb8f17a34833f74fe9478a253a7441f461bd80d99f15d52f21a7a9e61e5c745

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.mudanzasdistintas.com.ar
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    icui4cu2@@

Targets

    • Target

      Nuevo orden002______________________________________________.bat

    • Size

      84.0MB

    • MD5

      c4deb0e775ada24710322868786c06ea

    • SHA1

      a0b9f4806ad995bfc7a91fc55f6b1d13ca39f359

    • SHA256

      73a61a3210194826bff95994b29f43e906b2304ebd181371db8025785612ca3e

    • SHA512

      37277ebb1918a5924ad5cc98f063348381ec0f227c73cf3fb75e12a044608f104bb8f17a34833f74fe9478a253a7441f461bd80d99f15d52f21a7a9e61e5c745

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks