Overview

overview

10

Static

static

MAT_BAO-Do...pt.exe

windows7_x64

3

MAT_BAO-Do...pt.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8433455d529340cf75bc811fe9a3526c5c8c9675659a88936155f861eb2a704d

  • Size

    470KB

  • Sample

    220520-2rmeqafhb2

  • MD5

    8fd605556056de5ce9c60468e352590f

  • SHA1

    916523316d68f9618e272ce105550e63b61d7b97

  • SHA256

    8433455d529340cf75bc811fe9a3526c5c8c9675659a88936155f861eb2a704d

  • SHA512

    36c7917c5fbb82cc0d520de00d9a572e4ac9cf2b7f501d2e9c896419f7bb1c653df61b481aad714ebcbec96514901f98aed7a8ea456ef1ea98c24d6f2b942f73

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.bmmarine.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    h)%_GO?8$PS_erY39h

Targets

    • Target

      MAT_BAO-Document#20200627.ppt.exe

    • Size

      616KB

    • MD5

      9ec80f6e5410947c65a4b22a74eea652

    • SHA1

      5267449fd604844553526e4509a2f494537589af

    • SHA256

      91790ae3ca023feece6f78ea40830638f98b17469ddaed3e8184266f85141574

    • SHA512

      b5ae3ad60d9083b9e0e4dd42d65319b0266102f24f10ca9bcecacea6d77f98cab264a69d872423957fbea4ba7b5b579304d595b087cd8d967e8e7896272ac35f

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks