Overview

overview

10

Static

static

PO_SHZ41.EXE

windows7_x64

10

PO_SHZ41.EXE

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO_SHZ4128332S.IMG

  • Size

    1.2MB

  • Sample

    211019-nlynxagfcn

  • MD5

    496c3cdb328fb65d9a7f7a8136461159

  • SHA1

    38bf6cb84e8d1cd8e08c244ff210483377ed405c

  • SHA256

    175e981a152c22c1c3503285b4d1d2d1837f2119116881838f27d9972f63d8ad

  • SHA512

    6c85e768a9430d37acec8fff60fd3dded937927aa6d1da2cc930e111a70f761392cf86dc8b8cc833fe54365cae3e7940844a0c85383985b1f5cfa1f4d0cbab5a

Score
10/10
agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.mail.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    xxxlahot2

Targets

    • Target

      PO_SHZ41.EXE

    • Size

      72KB

    • MD5

      410cce7e5da174865ae1c5d65458d92c

    • SHA1

      0ea38171202123c4f0115cb5cefc578bc0b664a3

    • SHA256

      8dc1640499a6b1cac921adb0e5899e2fe02f4902b2f6acfa5d4f7c2f277e54cc

    • SHA512

      f7eca94b7ec65a7e932d0faeb37703c716b5856f71a696378c01e44ea3c4749b10892e877f4efc75797319648fbe77ad143cf53ba01f4324eb76e4be32128a20

    Score
    10/10
    agentteslacollectionevasionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • AgentTesla Payload

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

4
T1089

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks