Overview

overview

10

Static

static

1

Ref. #EXQ-...37.exe

windows7_x64

10

Ref. #EXQ-...37.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ref. #EXQ-21-2911 zip 325637.rar

  • Size

    356KB

  • Sample

    211202-qdmyjsbgf9

  • MD5

    96aa7d8e0cfb11061c4737b9ee9f7650

  • SHA1

    9b39c5c8761d8033389e861eb92a9d04ed502daf

  • SHA256

    879025f0c18c9b9f6ccd40c7cb080d9c1f1832a1a3e33ad4248f636ade5f5c06

  • SHA512

    a68027c9c846c2552f9c5918bcdbb582ca6c077bffa2229f64137c2676e3746aa6e5c55882acb161d7c5a2f63ab078e48b148029fdba4c8e9c00e9271690a14f

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2142399843:AAEIp_i4m3MsSw_cMxsjWVR6wiMUP2LDrvg/sendDocument

Targets

    • Target

      Ref. #EXQ-21-2911 zip 325637.exe

    • Size

      371KB

    • MD5

      ece9b6b1f88aee486ce02418c53a1b17

    • SHA1

      1e489c4d332257712d95ba2d6ff93329962c46bd

    • SHA256

      70c4072f4f52adc69c331fa7cf5d22bef0da2661a4d2d9b3efe18dd19c8388a2

    • SHA512

      63e97fc74d7d9088bc9ad9b9d458455c5f7949bfb44efb344590968b09a7d77f3b6ef58f56ad8d65092aaff5098a20125b3be7646739ea547c84234269b9d8a6

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks