Overview

overview

10

Static

static

HUJUoHNDvfZTiEM.exe

windows7_x64

10

HUJUoHNDvfZTiEM.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5286abbdb535d1ef9258f1003f8755072d700ba9874d29d4b07954aeca3d7f56

  • Size

    433KB

  • Sample

    220520-3ayl4abecm

  • MD5

    6a50f773559f3b0bac4fbb2ed34e5a17

  • SHA1

    7bbb10502ab88191ad76f1a1c2f46dc53bea69d4

  • SHA256

    5286abbdb535d1ef9258f1003f8755072d700ba9874d29d4b07954aeca3d7f56

  • SHA512

    92408510c1f819cc9045d01ea13590b16313252711dd1d1e70762899bc89609c303cd69ce32bec816fc639e832dda9bb9fb7e43cff40a0401967018aa3abf943

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.lettu.us
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    western2020@

Targets

    • Target

      HUJUoHNDvfZTiEM.exe

    • Size

      490KB

    • MD5

      f93a5756dce9c41e690029529f0dd25c

    • SHA1

      ccb444a4628fd2035aa38ff8a50727f4c0a67ffb

    • SHA256

      7e393bcd518415ad70e7a6924c8798391400554fce9c2a639a891dcda4f8e230

    • SHA512

      7ad1ca297782ce423311d11cb1f2932a7edb64a0364be54558e881073d3095a0b6993dcaabb01e34e18a89a2a134e3887dfac6beeb880f6463520d65b635e42c

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks