Overview

overview

10

Static

static

printing l...08.exe

windows7_x64

10

printing l...08.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    printing labels and items shipping marks for order 200018808.exe

  • Size

    653KB

  • Sample

    211021-nrqkgsbahk

  • MD5

    d66d39a631410003673f85a5c8293e85

  • SHA1

    a9d4a8f39d2a58e6134faabc937ca8cce58dae93

  • SHA256

    5e02cafcb735f048e38347099086988b2ee9d5c09956f95257602d3a45fd6716

  • SHA512

    8cb1f697e0a7725913971d7bcaf5cf8614247f45dff0e443f96d9e79e775cebcf7ca80977fca7ba9c6ace74ae99d477ef61ea8c084b2e1a18b3632d2f0a41a42

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.electronmash.com
  • Port:
    587
  • Username:
    office@electronmash.com
  • Password:
    Zanzibar2018

Targets

    • Target

      printing labels and items shipping marks for order 200018808.exe

    • Size

      653KB

    • MD5

      d66d39a631410003673f85a5c8293e85

    • SHA1

      a9d4a8f39d2a58e6134faabc937ca8cce58dae93

    • SHA256

      5e02cafcb735f048e38347099086988b2ee9d5c09956f95257602d3a45fd6716

    • SHA512

      8cb1f697e0a7725913971d7bcaf5cf8614247f45dff0e443f96d9e79e775cebcf7ca80977fca7ba9c6ace74ae99d477ef61ea8c084b2e1a18b3632d2f0a41a42

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks