Overview

overview

10

Static

static

ab.exe

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab.exe

  • Size

    903KB

  • Sample

    211019-qjmvqsggbp

  • MD5

    9ce4ad1c6b3922f9b1f5e791cd67ca4c

  • SHA1

    684fd0a504a88891c7886b2f66a88b31e19d4fa8

  • SHA256

    d70ef7100ac3b81d499e79035dd0b44c42ace5ae7b2b8a37a7d1eff742a27d9e

  • SHA512

    ae09c4ecab4681f41c7e68fceb7a68e18d7360efa6b34df5347951c7420c807ea2c53152f6782d1d38c138829aceb7c5c815078e6fa13bbb490e7d3cab52a671

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.manlogistics.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ma&*$367Jhn

Targets

    • Target

      ab.exe

    • Size

      903KB

    • MD5

      9ce4ad1c6b3922f9b1f5e791cd67ca4c

    • SHA1

      684fd0a504a88891c7886b2f66a88b31e19d4fa8

    • SHA256

      d70ef7100ac3b81d499e79035dd0b44c42ace5ae7b2b8a37a7d1eff742a27d9e

    • SHA512

      ae09c4ecab4681f41c7e68fceb7a68e18d7360efa6b34df5347951c7420c807ea2c53152f6782d1d38c138829aceb7c5c815078e6fa13bbb490e7d3cab52a671

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks