Overview

overview

10

Static

static

10

Please Con...ss.exe

windows7_x64

10

Please Con...ss.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c34205b4e8f316a75c6819a8c642461fd9b05b4f9862eb6e4f3e52fd11ef52bf

  • Size

    4.2MB

  • Sample

    220520-3vrdhsheh9

  • MD5

    9d1ce204c505307379e5182db70681e5

  • SHA1

    53a6baa83b8bcdcaf4caac86c332fc8d694faae0

  • SHA256

    c34205b4e8f316a75c6819a8c642461fd9b05b4f9862eb6e4f3e52fd11ef52bf

  • SHA512

    1d83ab04eb6ead64f3459d732b9126f600b5d7ee5f20a9c43de2ef96d9434b71fc3b765474d19c2ef2cae023a098f5ac1c6293e2b19999662a66da17181d58dd

Score
10/10
agentteslaagilenetkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Please Confirm Your Shipment Address.exe

    • Size

      4.6MB

    • MD5

      ffab58789a8d188f10ae6b7a9c73c36a

    • SHA1

      48bf4df2095bf4bb8fa53ddd10fbb0fef80dc494

    • SHA256

      f93ca4cd3ed07276972b89aee75211d52551197a2d1c5c8c3f01ed85aa13a4ea

    • SHA512

      c13ff615c4ae03dd33a5c4766be184c029aef24560703b8f59cf9fa54755dd9d68589234919ac4d02c77a05480f4c3795c53a1283cda1583ced8ea93f7dd322c

    Score
    10/10
    agentteslaagilenetkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks