Overview

overview

10

Static

static

paymentslip_PDF.exe

windows7_x64

10

paymentslip_PDF.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ae1f0e89676aef0ef50d46632884fc0802acd52d16a1385d7705a3c6234ba9a

  • Size

    374KB

  • Sample

    220520-3f1cwagha3

  • MD5

    970fab2b3feef01c7a9fa0099466dd20

  • SHA1

    f4098e5a8a578221d75c7052f0bf7dafe7bd5a2d

  • SHA256

    7ae1f0e89676aef0ef50d46632884fc0802acd52d16a1385d7705a3c6234ba9a

  • SHA512

    57d9edcaadf3be0b914d3fc7e9785e49a3ab74b9832ba477dbaac9f2929e1a5803960c9c33dffca190dfd48947420d90b9cff8e6a55a658ef60b140536ce58f4

Score
10/10
agentteslacollectionkeyloggerpersistencerezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.linxons.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    uk)e(tM8

Targets

    • Target

      paymentslip_PDF.exe

    • Size

      557KB

    • MD5

      4c30bb1280bfa889635bee28a5f7b656

    • SHA1

      3eaad24b7751bba0761c1ba2bb44357d304f5a69

    • SHA256

      120cdf50d845fe285f219565995bd3a89077baa57202511d6d11eb5d059b08d7

    • SHA512

      a875f7c664761b3e9951cea017d341d89c3a9dd642eaac609619bbac815b18c7cea8ad54374da533df69e3dbbcf251b7b219bbc94f709acc6fcecc68bc5328f2

    Score
    10/10
    agentteslacollectionkeyloggerpersistencerezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks