Overview

overview

10

Static

static

Order(2)34014072.exe

windows7_x64

10

Order(2)34014072.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a64c987e8082a94e12e4900fffffc370947c8afe55a39a4a5d2f4b8d263ed474

  • Size

    383KB

  • Sample

    220521-aac16shhd2

  • MD5

    23c9da60aac83ecfdd94320637ba4140

  • SHA1

    c25dd8287105b39201d3c7ddd45a361ce2ce483f

  • SHA256

    a64c987e8082a94e12e4900fffffc370947c8afe55a39a4a5d2f4b8d263ed474

  • SHA512

    30a505db7df8ff89c5006304c3ec06c3dc6a74afcada10ca41fdcfb11b50b1de7d0b4824ccb3e703d0117bd98ceb5bb5c7e71a9dc6bd44c11c97c46ded48a73d

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dmacdavid

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dmacdavid

Targets

    • Target

      Order(2)34014072.exe

    • Size

      575KB

    • MD5

      809e1f217c74d22103f4384ffad1d67d

    • SHA1

      6913e1db75535dab4e1cc08610aeadccdd2a47e4

    • SHA256

      f96a186d42be8ee969291167ad5f02198788ce013945bf13e02ee13ce4454049

    • SHA512

      c974c1b9bfd35c6d453a353b73e5930c5dde0425ca15fec8aaa77ee30929e9e952bf7045fd6e20433b42f6ab496f30663dc4513725418d5143bd53e35b2ddcaa

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks