Overview

overview

10

Static

static

201586.exe

windows7_x64

10

201586.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    201586.exe

  • Size

    795KB

  • Sample

    211018-z42n3afgdm

  • MD5

    8a6465a960395e718b9489c5738a1714

  • SHA1

    fc72045fbc8157ed4035d53f12cf36738ecad644

  • SHA256

    fe8fd282bdc1f838ff2dad9b56b6bd615fb7f76fa69775c5afd5ee204dd007f6

  • SHA512

    7918da056a93b0e03dd79f18fd6f6360ca945342619cee7f19329069ad9c495947de345dca6b7aaea27184574056b80ae5add6079e0f7e57f33de0121f68c7b9

Score
10/10
agentteslaagilenetkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.merchantexint.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    merW&13@

Targets

    • Target

      201586.exe

    • Size

      795KB

    • MD5

      8a6465a960395e718b9489c5738a1714

    • SHA1

      fc72045fbc8157ed4035d53f12cf36738ecad644

    • SHA256

      fe8fd282bdc1f838ff2dad9b56b6bd615fb7f76fa69775c5afd5ee204dd007f6

    • SHA512

      7918da056a93b0e03dd79f18fd6f6360ca945342619cee7f19329069ad9c495947de345dca6b7aaea27184574056b80ae5add6079e0f7e57f33de0121f68c7b9

    Score
    10/10
    agentteslaagilenetkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks