Overview

overview

10

Static

static

DOC.exe

windows7_x64

10

DOC.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d077c534a032b889181aa23a82b7b4be9c1ed66ac7075643a2c86a82ce56c25

  • Size

    380KB

  • Sample

    220521-acemsachap

  • MD5

    97b27135ae711122a6026e940e29f37e

  • SHA1

    21229b0489be97cd377ad5dd35171ee622fe6e76

  • SHA256

    9d077c534a032b889181aa23a82b7b4be9c1ed66ac7075643a2c86a82ce56c25

  • SHA512

    e672e9de268212604ab6805260dc16e6ca2e17bb88b6a071a13fc44b315e4f4981a16f221e30f1d0ade707539b38071e281fe6494a7d4a6da5fed8cea6d724b8

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.el-sever.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    admin123

Targets

    • Target

      DOC.exe

    • Size

      636KB

    • MD5

      c2dbd23d7d1429c00ac1054a2befb929

    • SHA1

      20c144e6919f64dad5cff37b29da1030d5044300

    • SHA256

      ca00e2766617e6a0d743880ad74f65b035e04192914a938a6610f6fd813c6c0c

    • SHA512

      207753698017d2761d4b1e782d8b27fda43c71fe077989f9343c773a1ddbd49bd92a2dc57fc30d30c89e017db0b3be3de614b656137069198034aba43ee0949c

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks