Overview

overview

10

Static

static

BL DRAFT COPY.exe

windows7_x64

10

BL DRAFT COPY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BL DRAFT COPY.zip

  • Size

    392KB

  • Sample

    211201-jpvdfaagdp

  • MD5

    b7cfce8a4af0c9486b414749d56501bd

  • SHA1

    b5e9f8f9ab3f6b8e42900d00391a7963ab6b27fd

  • SHA256

    a2a7b118f19ec3c310046dc91adb960de63d224978e76a80028360614b0a89cc

  • SHA512

    28558121c47f1d8bdacf331e91500ce1de5548c1e89d966ae2006e62879a44c4b6d02f210dbd9898f98ab16ec6d5b1e7813841b07f0cb2fd863f84d0e2d94eab

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.khawambros.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    1EJRh0xnEN549JSbdZHz

Targets

    • Target

      BL DRAFT COPY.exe

    • Size

      513KB

    • MD5

      e6724029c9afbedfb3444b1376009152

    • SHA1

      a492738237fe510c57b792353971865974a9c0c3

    • SHA256

      0e1520040239e949acaed29e68fb90f58d5dbf757f3b3abe5727cad2c35e470c

    • SHA512

      09fe868d9c3448e0f9a9a04133109517f15c4e3b05e0c3b7c8f143d6c3af2b7a36246a429da731d2d1784f3ccb2edde3e45b6a90d107a9c684420d7f84f5066d

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks