Overview

overview

10

Static

static

4a9c536d.exe

windows7_x64

10

4a9c536d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a9c536d.exe

  • Size

    742KB

  • Sample

    211023-jr9wxadbcr

  • MD5

    9d4223f3d591d637560cab84f1423256

  • SHA1

    be4ccc37f91857a0f8f3fc88934f5788ce48ff2c

  • SHA256

    4a9c536d52f1f4f5c386866c763ecf23089fe4133da7894a04f3b14c624c87d7

  • SHA512

    2dd55308a438c12a0b93b35d8877260055484a1fae30a61e3c550113c5c96c835214c5166972e4b16434dfe478f35213bef7deb365be4cf3ada62dfb4c56850a

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.italfood.ae
  • Port:
    587
  • Username:
    admin@italfood.ae
  • Password:
    aDmin@IT$732

Targets

    • Target

      4a9c536d.exe

    • Size

      742KB

    • MD5

      9d4223f3d591d637560cab84f1423256

    • SHA1

      be4ccc37f91857a0f8f3fc88934f5788ce48ff2c

    • SHA256

      4a9c536d52f1f4f5c386866c763ecf23089fe4133da7894a04f3b14c624c87d7

    • SHA512

      2dd55308a438c12a0b93b35d8877260055484a1fae30a61e3c550113c5c96c835214c5166972e4b16434dfe478f35213bef7deb365be4cf3ada62dfb4c56850a

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks