Overview

overview

10

Static

static

Consignmen...s.ppam

windows7_x64

10

Consignmen...s.ppam

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Consignment Details.ppam

  • Size

    5KB

  • Sample

    211027-bc36taadh4

  • MD5

    f9d2f6aa2818e3650ad78eca52d06ad7

  • SHA1

    c0c6c5e57968b372b30a939cc2db89b93acc99b1

  • SHA256

    3ed7cb075765f5e5ab3d98021d4fdf3e81498709452af99a220f3f831fe46353

  • SHA512

    86187429d31b9a6cfbc62b8ab5876a6ed76e8a15baa5bec9fd7bbd9d3b3642de8e598f7ad6727a0eb1a4da9963c974d23419baf3790548f9f05ec268256a2961

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Consignment Details.ppam

    • Size

      5KB

    • MD5

      f9d2f6aa2818e3650ad78eca52d06ad7

    • SHA1

      c0c6c5e57968b372b30a939cc2db89b93acc99b1

    • SHA256

      3ed7cb075765f5e5ab3d98021d4fdf3e81498709452af99a220f3f831fe46353

    • SHA512

      86187429d31b9a6cfbc62b8ab5876a6ed76e8a15baa5bec9fd7bbd9d3b3642de8e598f7ad6727a0eb1a4da9963c974d23419baf3790548f9f05ec268256a2961

    Score
    10/10
    persistenceagentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks