Overview

overview

10

Static

static

ORDEN DE C...__.exe

windows7_x64

1

ORDEN DE C...__.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDEN DE COMPRA 80107.pdf________________________.exe

  • Size

    229KB

  • Sample

    220124-qc8hvsehbj

  • MD5

    af7c27fd6e49538aa93a667d67463c51

  • SHA1

    e2da9a0143a07da2b2c498f4622ea5db21d9298f

  • SHA256

    d7553925a2f9d9840cd23da20f66fcbfb3e7eca2f24c624e2f6139181eefc138

  • SHA512

    6fdf0a2efc97e8c69c8aa97d4a2f47826c7bc201a8db4323f41ac097925c0c5e919ec7df5e72579d61dab3e7e38f8e8a324ca8a336b55e2ce756838a9bd08122

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.bhgautopartes.com
  • Port:
    587
  • Username:
    kubaba@bhgautopartes.com
  • Password:
    icui4cu2@@

Targets

    • Target

      ORDEN DE COMPRA 80107.pdf________________________.exe

    • Size

      229KB

    • MD5

      af7c27fd6e49538aa93a667d67463c51

    • SHA1

      e2da9a0143a07da2b2c498f4622ea5db21d9298f

    • SHA256

      d7553925a2f9d9840cd23da20f66fcbfb3e7eca2f24c624e2f6139181eefc138

    • SHA512

      6fdf0a2efc97e8c69c8aa97d4a2f47826c7bc201a8db4323f41ac097925c0c5e919ec7df5e72579d61dab3e7e38f8e8a324ca8a336b55e2ce756838a9bd08122

    Score
    10/10
    agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • AgentTesla Payload

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks