Overview

overview

10

Static

static

PAYMEN.pdf.exe

windows7_x64

10

PAYMEN.pdf.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46bd933a2f3d328c9b9665c2b8c9907600e14b3542d9aff1e8526593cd03a3cb

  • Size

    438KB

  • Sample

    220521-axdk8aahf3

  • MD5

    21802db473eff5bafefc5a065d51a270

  • SHA1

    b9948b9ac967ab3e3663e3cfa3e75b734851baf7

  • SHA256

    46bd933a2f3d328c9b9665c2b8c9907600e14b3542d9aff1e8526593cd03a3cb

  • SHA512

    9261281cc0f68bb8ff1399d496b98c192487cb7729334f7abc80cc603c2b34556e733a1a23e7018a6474c63c04829e8b1a0492d217dd3db91dd350e0c17c4cca

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.daafco.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Rawan!@#

Targets

    • Target

      PAYMEN.pdf.exe

    • Size

      648KB

    • MD5

      463c68f81d7624d1a22aef526b98ff62

    • SHA1

      047605c15f2fa7421c7855e2410ae1de5a337a3f

    • SHA256

      638603145c3aac570237325613344a3fd83bf2fc737ee5acd8230e0ee1afb0f5

    • SHA512

      5ff2d32b68fc4a9b3c9babbfdad0c9b621c88dbc402f8edc1c4a4893d6e2c5f3b74ad5f73586ba5e58f9bc859840d1e80288e3cadd8205ab6be77b89a8f20e1b

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks