Overview

overview

10

Static

static

Due Invoice.exe

windows7_x64

10

Due Invoice.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a79ec100c7ba4df9ecba5aa57f0e62ba2712687b1cc7fae30f795184b63c58ba

  • Size

    341KB

  • Sample

    220520-29b2psbdeq

  • MD5

    0059f43909e0cc3b6f684d9eb7ab2b9c

  • SHA1

    05c27989ea1484bd9c5388ee7aa1c9ba86189483

  • SHA256

    a79ec100c7ba4df9ecba5aa57f0e62ba2712687b1cc7fae30f795184b63c58ba

  • SHA512

    72841022d6e3e63f3985526f025e639def8f2d3cffd57cb7fd984b34cc242519cbf1288f99c86502e3f28c82f8ff853d76041a8b88daa4b6a5c1ec8011d042bc

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bigboy5570@@@@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bigboy5570@@@@

Targets

    • Target

      Due Invoice.exe

    • Size

      410KB

    • MD5

      84dc340e56d31e9da2e04d9cff00c89f

    • SHA1

      ee3590a44a19694e1f30efba34fc8e6c393620ff

    • SHA256

      a17438d009e8a6e90b846941faaeaecd1a71951f97d4b8aa312ad1b2b7a420b2

    • SHA512

      a2976b236827c9dbc1a05ff653cb1ce3bdf227e4848d4462b83f45fbc0dcf5d238a5da1c86b0023ed9f946e65998cb4eb274ba64e886e1b80d5401d4f952034f

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks