Overview

overview

10

Static

static

1

Partial Sh...wp.exe

windows7_x64

10

Partial Sh...wp.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Partial Shipment.gz.zip

  • Size

    452KB

  • Sample

    211203-t4cgaahaem

  • MD5

    1339b57b4720b0f8e354e22a7899aacf

  • SHA1

    7b7bce63e6fc783315b2882c1bee462e4a4584fd

  • SHA256

    92ca05efcd22d300759817aed174c7aa91030f966a1bd8ae4a35430b97429d1d

  • SHA512

    7774180550e9839d321807e32cb9701e02d2da2280b36a22555bbaa3e03819d98c309dc9eb199efd72ffdb404f6196882542a3d9338d7c78f0568d3ec8b2902c

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.scahe.co.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    scaheavy@12345

Targets

    • Target

      Partial Shipment/newp.exe

    • Size

      571KB

    • MD5

      4ee15954d954941e65043fd7abd506db

    • SHA1

      42e2a770d730d6874f40b4f83e885a3c6e737b4b

    • SHA256

      9b78043d9ee5d318e4d5f3fbb0fc07ff1fe364a77673a54e6a39a14c3a8edcd2

    • SHA512

      d37297453b35f295b7d4043199341c7b09e6a3d2f5ee33412ef7dd5c2e6295af1d1eeaee9ef316064dc3da24d15685dad03b70f67afde4e1ca101299c144125c

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks