Overview

overview

10

Static

static

Bank Document_pdf.exe

windows7_x64

10

Bank Document_pdf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    65e9bc1d22e37a239e3981df522d7fdc875bfa28522bbee6b3c858b45a110cf2

  • Size

    346KB

  • Sample

    220521-apt81aafa3

  • MD5

    0e1c7623bf2db6f2978cbcdf1ce9f1d2

  • SHA1

    54244bc725ddad63cc2e2aaa819645cfb7b78516

  • SHA256

    65e9bc1d22e37a239e3981df522d7fdc875bfa28522bbee6b3c858b45a110cf2

  • SHA512

    cc55eca39fccaeb8d0c8fd20a1dc23a703d906f3aacee67d4bc0775f0af867061910ca96e4394d8c9527a29edff82fcf1c4d00a9038e2c24ffa389298d90d02c

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    bh-58.webhostbox.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7213575aceACE@#$

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    bh-58.webhostbox.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7213575aceACE@#$

Targets

    • Target

      Bank Document_pdf.exe

    • Size

      513KB

    • MD5

      186a0313d134f01988ea623a10298146

    • SHA1

      efbdcfc82e3f54b542e9b837d9f2a107bf585965

    • SHA256

      9d604c08ee1d3c2f747a0813ba0b38fb34477eca74a73176939f5a37a1ba5bc5

    • SHA512

      b49f90b0e5012da795834b23936693841c4418d842b0287bade25ef5a643dafc9796e548bd89660584c55d6265b2fe47f704e80d7f8f1eb073ef2fb045a484f0

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks