Overview

overview

10

Static

static

eElectroni...02.exe

windows7_x64

10

eElectroni...02.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a97433c798770c33669b67b7d9aea7df3be6eb640766798c2dff38366688bed2

  • Size

    766KB

  • Sample

    220520-2bckksfad6

  • MD5

    6b8c1bc7adc776a8fad3cb05ac26d2fb

  • SHA1

    6e6b1df9630e61a77def607dd88734f2eb073a9d

  • SHA256

    a97433c798770c33669b67b7d9aea7df3be6eb640766798c2dff38366688bed2

  • SHA512

    c55e19b787854f50a8ab78a3496bdfb4e2b611d46e93503d05f6ca742af3e31a220fe52b405bb569d409fc7386abac18224fafe373b252c56d61f2655227bc34

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.rebu.co.rw/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    o^Z0CIU?^yL2

  • Protocol:     ftp
  • Host:
    ftp://ftp.rebu.co.rw/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    o^Z0CIU?^yL2

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.rebu.co.rw
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    o^Z0CIU?^yL2

Targets

    • Target

      eElectronic Flight Ticket Booking Payment Confirmation XXXX7383929837 Debit BNC9929302.exe

    • Size

      1.1MB

    • MD5

      0280d4564b4f61ecb14c8c723f6273b4

    • SHA1

      3e346691b8c36eb2de0987558cdcbd578e27b6ec

    • SHA256

      b47db9d3513d9c87269f53d0d19a387900a0a8b19da2122b963851589372be7a

    • SHA512

      6a07a149979bbc2374b28494aa90eebc590921049d694507f71b57e30164ea0b547bb697dafd02e609722a9c6f2d0179de3d2855a13f88d9c9b38861ddceb9ef

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks