Overview

overview

10

Static

static

Purchase C...PK.exe

windows7_x64

10

Purchase C...PK.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    490539bcbf6c58dbf83a49ffa8d54876090d97685c581833b643852d9d1cf346

  • Size

    635KB

  • Sample

    220521-b35sbsgacl

  • MD5

    2084f2abe79a183236b4a5e778946659

  • SHA1

    85d701a8076f992dca8f8d4db5b697d81bb6fdeb

  • SHA256

    490539bcbf6c58dbf83a49ffa8d54876090d97685c581833b643852d9d1cf346

  • SHA512

    aa8fcfcac8f1354801025c501cb1f8c3e6c671798ef835df8991cd131d5294914c84435fe74c0505f1350d1efe5abe2faf6950e4bdc2f578bd8872c7a318d525

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @damienzy.xyz2240

Targets

    • Target

      Purchase Confirmation INV00453-PK.exe

    • Size

      876KB

    • MD5

      42e689cb42449f76f6482c91f0ff1d23

    • SHA1

      26c38aaa54d9c4284f519f9a1665ff7a4e74f1bb

    • SHA256

      b0fcbd261a94dd884ba982c70ca14676610a4c582d442aa015402e54701e4b3f

    • SHA512

      d7622b00e76c43c799ff9f42dc3eafb55cbfc24e244edd421b4c9d3a2f7c88d28aeef4d215e0691a31b7d40ca3d022dba9324cc372eec735697ad8fe4d0e915d

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks