Overview

overview

10

Static

static

BL DRAFT COPY.exe

windows7_x64

10

BL DRAFT COPY.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BL DRAFT COPY.zip

  • Size

    467KB

  • Sample

    211202-p7wbcabff3

  • MD5

    c9312caaebc0c09d05c67f7d80d9c721

  • SHA1

    667c44cb9fe9b82fd07874b5f18a88c5645dbe4c

  • SHA256

    ecdcf1a0cc24f0c456eed1c08f60fb2fc0b369394f3216a1fe7211923a3f936b

  • SHA512

    e98c02014ecdcba92df3ca4e8e19904d09a420a375b9c156f34085fb49b449f5856b67ada59b247c164a7837b53ecf97d001c2434e7c07a0157f0fcb2ca9b839

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.dieseltronic.com.pe
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Asdiesel2019@?%%%,

Targets

    • Target

      BL DRAFT COPY.exe

    • Size

      571KB

    • MD5

      38b5e64b40b7385e941853fafcca52ed

    • SHA1

      3500d74b58a12151a541865eb72e54dc97553a8f

    • SHA256

      0a15fc96322463009c95cafcf720acb2eb9dbee7baffbd1131532891db885a6e

    • SHA512

      33b99a75e63d5d4497ef6a85e2a9f6cd3248a1110acec2864457b300194acdd582d9da6e932d9abca9265613495bbc753777066d4181462aef08862b89f96d6a

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks