Overview

overview

10

Static

static

Order spec...cx.scr

windows7_x64

10

Order spec...cx.scr

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order specification & Drawing_Docx.scr

  • Size

    1.1MB

  • Sample

    211020-gbqrzshehn

  • MD5

    822545bbbff1e68337bfd9e87ab08aeb

  • SHA1

    3182db783dd2713d9971bf6539304c83eacc0b35

  • SHA256

    bb6424f6051455bd165527d6fd1fc1e6d48292562eb17ea80425018625126f3d

  • SHA512

    397f993ffd183ab7651fe3a00f18fbea0712e39fb0ef4377e33b7b91961b1bbaef8ed381e9d547bd81472dcb309fe0365b10316fbf5dae44b1fe1f2f6c496a90

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    secure300.inmotionhosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    HCBo3_tl-nKP1@

Targets

    • Target

      Order specification & Drawing_Docx.scr

    • Size

      1.1MB

    • MD5

      822545bbbff1e68337bfd9e87ab08aeb

    • SHA1

      3182db783dd2713d9971bf6539304c83eacc0b35

    • SHA256

      bb6424f6051455bd165527d6fd1fc1e6d48292562eb17ea80425018625126f3d

    • SHA512

      397f993ffd183ab7651fe3a00f18fbea0712e39fb0ef4377e33b7b91961b1bbaef8ed381e9d547bd81472dcb309fe0365b10316fbf5dae44b1fe1f2f6c496a90

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks