Overview

overview

10

Static

static

13.ppam

windows7_x64

10

13.ppam

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13.ppam

  • Size

    6KB

  • Sample

    211026-ya98nsabf3

  • MD5

    03bbdcead22e9329a234dc39f55f0a2b

  • SHA1

    465b5a304541a673ce583bc20d2dc4746ccec421

  • SHA256

    deef43f7490a5db9f8f9b688d8bc669ecc360d068e3b40e39de124f85068db2e

  • SHA512

    af1dde717ee4c195dd32873ed4205d8b98fcc783bc4379360db084ebb4275ff78361c3be69722698f214f5493205d0753ff9748497ffeee88449077f04031529

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      13.ppam

    • Size

      6KB

    • MD5

      03bbdcead22e9329a234dc39f55f0a2b

    • SHA1

      465b5a304541a673ce583bc20d2dc4746ccec421

    • SHA256

      deef43f7490a5db9f8f9b688d8bc669ecc360d068e3b40e39de124f85068db2e

    • SHA512

      af1dde717ee4c195dd32873ed4205d8b98fcc783bc4379360db084ebb4275ff78361c3be69722698f214f5493205d0753ff9748497ffeee88449077f04031529

    Score
    10/10
    persistenceagentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks