Overview

overview

10

Static

static

Proforma I...df.exe

windows7_x64

10

Proforma I...df.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proforma Invoice.pdf.z

  • Size

    444KB

  • Sample

    211019-hsmx4agccn

  • MD5

    25c416091c47cc01fd7b404b21e097a1

  • SHA1

    28b55b3be4a7773fd0064a501e05b9dffed62278

  • SHA256

    02775b6ac6554e57854050cd6462a2bb1086a45607b6a5f22b6fb111e6880391

  • SHA512

    618b376ac762b7d80634b1f5bc3c01fb55f2157fe53293f29614f27a3f064b328d1063f766142e2748b4ae354e5d12221434841959d6215df2f666b8e3cc1853

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.daproviaggi.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    vacanz.E43

Targets

    • Target

      Proforma Invoice.pdf.exe

    • Size

      551KB

    • MD5

      4aed86a83d6470edf10d71508c18e3c9

    • SHA1

      871973f1e5c71dc0d7e2b6bcd080be3d58b713f1

    • SHA256

      d83c9b45e97010c3c45988042a6f4e6c6c0945425853fed6f821aa0d28652f68

    • SHA512

      5d55f756f6483c075f2bec2650a8aec221fbe29f45f2425241e4a338c03eca6c01297b08d17da0abb1e2cbb038ac398f893ad25daa7c3e5432afd047830a9713

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks