Overview

overview

10

Static

static

PuteraQuote.exe

windows7_x64

10

PuteraQuote.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cae64c130c8e3cd4216616875bb3ec86626eccb18bf35bc7807179c9c31bc43c

  • Size

    384KB

  • Sample

    220520-3tadlsheb5

  • MD5

    3a7828097c6faf7eb575b00503524f2a

  • SHA1

    39dacdcc38f320dee543f569c8e4586f67906369

  • SHA256

    cae64c130c8e3cd4216616875bb3ec86626eccb18bf35bc7807179c9c31bc43c

  • SHA512

    e2a3b42b0696d0361f479d26fd36407ac40b3305b6e84e5cfaca347964692e808feafce8d215d6d61ee4be8a3cf9d0e8cdfa60eb37722f286d2ad5ae62f4302e

Score
10/10
agentteslacollectionevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    ike2020.xyz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    $logs2020

Targets

    • Target

      PuteraQuote.com

    • Size

      551KB

    • MD5

      17a99416bdef6913f33c12165c433b78

    • SHA1

      c6c53f51c89c3aaa267b6d534259c38707d651de

    • SHA256

      78fe45d6d5097ad57ebd01a350321546e60e79451b89ff0c45ca781f3c4e35fd

    • SHA512

      198f71be625633f007c8760fca8ea3a77d6ce75851670b6d1f688250777e6e85b4952195a493dffa5cd928ca87c8c6844881b082f041c9d28d94c3c361cb7f90

    Score
    10/10
    agentteslacollectionevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Accesses Microsoft Outlook profiles

      collection

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks