Overview

overview

10

Static

static

_CNXTHG2.EXE

windows7_x64

10

_CNXTHG2.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    #CNXT-HG20211019.IMG

  • Size

    1.2MB

  • Sample

    211019-b2awkagaep

  • MD5

    2ed6d828b1dff1c3da94ef89bc9999bb

  • SHA1

    72df06cdaa977a4fd2c7b684932cd1abd6416572

  • SHA256

    6ae09da6c46ebbcf7349275f0df74d6e5f652141fdd1ee73505f9a02d00d1a7e

  • SHA512

    99b0315b82aeea06a1f82c92e9e0695a53d85ea39fff6c568a64e5325e29cb3afa11dda0e3abe7d49c40bccb1f228c7296eb13b2744d73b9ef895c3c5b0f648e

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.omindexgroup.com/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    UfB@t!s%IxwV

Targets

    • Target

      _CNXTHG2.EXE

    • Size

      597KB

    • MD5

      6e0929f7dd27fbd8a1e8dcc5ce64a8ab

    • SHA1

      4b7d56b114757b315531e793ec1a350cc9c260e8

    • SHA256

      0ddffa900afacce4077361358e7b2b84efcec6a89814d21cff463976070f2be7

    • SHA512

      bfa4d9bc057c2cdd2c74a01042eaaade3123a4602354f1ce4a904beed8f5a01142943df7bd443764a2b1250a6b1e5b39e2205bbe097abdb69a5522d49cff57ce

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks