Overview

overview

10

Static

static

Contract INV.exe

windows7_x64

10

Contract INV.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5

  • Size

    456KB

  • Sample

    220520-151c3ahghn

  • MD5

    e1a7306d80707989d7fb50b4bfb1a58c

  • SHA1

    673f21e3c05cc3cf77275790f3ba83902e0d4b3f

  • SHA256

    f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5

  • SHA512

    f27ee0681587cc3bf7c05f639dadc72aadf99193c65b173b85e7aae059bc99b8dc30d1724151c916626cb55f048862d7062210f02cd6c78f0701f4020267ff33

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.transfastc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Godalone147

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.transfastc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Godalone147

Targets

    • Target

      Contract INV.exe

    • Size

      509KB

    • MD5

      a5a33692171dfcaea7c829656937f4ee

    • SHA1

      ef45fe385cb22c559678c8204308898e78b8a874

    • SHA256

      95288eb9eb753179b5e44337933fa86d6d60889fe7189b445c73b8cc77f05240

    • SHA512

      e177455d9f75ce657d36e9492e98dba6a351c1665c7e8429c25fa3ef909122e2a31a3665ad2b615cb7ae23b9cec8023760f3c65844867a3a36f9780925b02b63

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks