Overview

overview

10

Static

static

PO_KIS10.scr

windows7_x64

10

PO_KIS10.scr

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b5300bcec026d4c17298a74342552eac5a8b1a6c27ad21649b392b67e436b97

  • Size

    1.4MB

  • Sample

    220521-b2a7bsfhep

  • MD5

    4f74f00ab9582f1a14996d74628f263c

  • SHA1

    18df83383cce0f4c41d7cdfa0c9ed02290a0dce4

  • SHA256

    3b5300bcec026d4c17298a74342552eac5a8b1a6c27ad21649b392b67e436b97

  • SHA512

    4daee7d8df3772d4e909eaf0d98a40415a8a396eabb8b43348be8080b2921c64a26a7cbe87b4b720b6ed9c4470bf8dc31d2ed4f1baad7600e50c2a6c06ad43ef

Score
10/10
agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    moneyman147

Targets

    • Target

      PO_KIS10.SCR

    • Size

      826KB

    • MD5

      8d6e3d7db41eb59119d7e3d215be221f

    • SHA1

      5fd08c7e2719c60bf2c438c81beb5dd891a66e6d

    • SHA256

      a9c6ebe45d33c431aa47b65571cb8d4d0d56d439cea807aa603c744cf4105a1f

    • SHA512

      b13b36fdf67448188d196df3bdd93ae6d2afcd3a6cbdab76a77b1bbc7f1725ebfb48d429b75ea2a3f6bd9bd73b50a8a400309dc4417b49a136ba6fc93499a766

    Score
    10/10
    agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks