Overview

overview

10

Static

static

documentos Fedex.js

windows7_x64

10

documentos Fedex.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    documentos Fedex.js

  • Size

    1KB

  • Sample

    220103-rt6ahahhal

  • MD5

    42a82a614937b74596344fa2a1a7c737

  • SHA1

    c13081e8eba34ca1619f7e8a11e2e8677878d292

  • SHA256

    46dd53f3096877a4cad89b77f2d23018d8bc5887a9c0d699cb43ffe9d0b5e29d

  • SHA512

    a9841b2fb08bc50a6476d366d5f8a44e1dec00d541f81e2a5829a09221313efe535470d06b0c5aa5c4d3beb3c4c18a72f96cfab329e88e66b39ce416ad7bc601

Score
10/10
agentteslacollectionkeyloggerspywarestealersuricatatrojan

Malware Config

Targets

    • Target

      documentos Fedex.js

    • Size

      1KB

    • MD5

      42a82a614937b74596344fa2a1a7c737

    • SHA1

      c13081e8eba34ca1619f7e8a11e2e8677878d292

    • SHA256

      46dd53f3096877a4cad89b77f2d23018d8bc5887a9c0d699cb43ffe9d0b5e29d

    • SHA512

      a9841b2fb08bc50a6476d366d5f8a44e1dec00d541f81e2a5829a09221313efe535470d06b0c5aa5c4d3beb3c4c18a72f96cfab329e88e66b39ce416ad7bc601

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealersuricatatrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

    Defense Evasion

      Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Tasks