Overview

overview

10

Static

static

REMITTANCE...f..exe

windows7_x64

10

REMITTANCE...f..exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcf30d6873c46c59ea16df5d1e0cab2f2d8fe00674254040fb2b18906fd3972c

  • Size

    456KB

  • Sample

    220520-3pg8nahcd5

  • MD5

    f8119d0a1b987c75787a72ad142abc8a

  • SHA1

    137612d1360dfaea9930d4d9589a45473305b30d

  • SHA256

    dcf30d6873c46c59ea16df5d1e0cab2f2d8fe00674254040fb2b18906fd3972c

  • SHA512

    5914b8c308f6cf181c0e9fe2a820f08276ee6b9bedcb25d1b83d47adfd376f6c3278913a569e99fde1fd2432e45bd420244a45c833a2fa0d26e46ef83e1053d8

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.stankovic.hr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mp58zg

Targets

    • Target

      REMITTANCE ADVICE IF0112000212823419.pdf..exe

    • Size

      714KB

    • MD5

      1a25e75693b99ad09e55aea29c6f2775

    • SHA1

      127c636848aff40eb37c0bdb325ec7d1c4c3bfca

    • SHA256

      c2bc9f2091a56e2d7045ddc273ba91462252f51baec6e6e62f6d0a08735564dd

    • SHA512

      c3fa5315b9069ce059203273536d42e337504bba5b7c31570298356b32219e487b7ee99d43ad81dbae2bc1e9da06cf0f2c87fedeeb755a921056a5be65daabd2

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks