Overview

overview

10

Static

static

PARKING LIST.exe

windows7_x64

10

PARKING LIST.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PARKING LIST.zip

  • Size

    467KB

  • Sample

    211202-qarsbsbgb4

  • MD5

    60c813f9b6c6da24237aa2f9133ef30e

  • SHA1

    8bb4c28d88c1129b78dc02e42ac75f1170e50523

  • SHA256

    2e09f4d6c413884241ff3dccd26e0821459e6d84cb2797612108fd7c2fe49ebe

  • SHA512

    239ae51fd758ea1b8157a6596c97424ce682ad80119bb1f8b303be3b51ff4cdb705873dd5d5c5abdec04e5520e3a5399d80202e2adffed15f1ab263cd3e4b0ed

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.dieseltronic.com.pe
  • Port:
    587
  • Username:
    asistente@dieseltronic.com.pe
  • Password:
    Asdiesel2019@?%%%,

Targets

    • Target

      PARKING LIST.exe

    • Size

      571KB

    • MD5

      38b5e64b40b7385e941853fafcca52ed

    • SHA1

      3500d74b58a12151a541865eb72e54dc97553a8f

    • SHA256

      0a15fc96322463009c95cafcf720acb2eb9dbee7baffbd1131532891db885a6e

    • SHA512

      33b99a75e63d5d4497ef6a85e2a9f6cd3248a1110acec2864457b300194acdd582d9da6e932d9abca9265613495bbc753777066d4181462aef08862b89f96d6a

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks