Overview

overview

10

Static

static

proforma i...st.exe

windows7_x64

3

proforma i...st.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    proforma invoice packing list.7z

  • Size

    596KB

  • Sample

    211201-rnf4esfhc7

  • MD5

    fc17d1c66efb0295841b8c3e98e43585

  • SHA1

    e496ed84f3881020d3a2a191d82d19906a2be70b

  • SHA256

    e53e055f73bf831b81bdfbfebd66fa4168a637322af475e226d1d591cf49127c

  • SHA512

    65cf315aa0614f4289a7e84d7bb120acb8e2917f17058eac8047a2fff5af613346264c83565b5a6299197aa743649bba52b89ee698bc4762241cdcbd6bf8711a

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2129831935:AAFsDWWUF1IwkP0mys1D0YX41mjPAs-L-eU/sendDocument

Targets

    • Target

      proforma invoice packing list.exe

    • Size

      634KB

    • MD5

      48fb8e04e65715d3b3061ae94cd2c05d

    • SHA1

      3b902deb417733907561e79706a4834e754231b7

    • SHA256

      e5f9ad28d453a801995d0505222189cfcb86ea7baa429979c21f85ca11adf7fc

    • SHA512

      c7213cc8e34fca207a3f01f3f3d79a502345f576d32361465f899f68758e29d301491ad4d96fba83c7bdeff66cf3bd4dc79663654501f426b8e58122b3f27eb6

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks