Overview

overview

10

Static

static

SIGNED AND...CE.exe

windows7_x64

10

SIGNED AND...CE.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    289c109e239ee7570e68e8703e4c64fc45726f50766fe8b1b4d95e9073fe0b35

  • Size

    409KB

  • Sample

    220521-bbzf8sefhj

  • MD5

    f12c848be2624eeeb6862dbb03e30f58

  • SHA1

    fe11835a0d6abcdda74160d34ba0ac0f9b564520

  • SHA256

    289c109e239ee7570e68e8703e4c64fc45726f50766fe8b1b4d95e9073fe0b35

  • SHA512

    9f74143e695e2bbd5a60445ca51c2e986f50f37ac01bac22890a0bf3d0357c26e7dddc2000cab1522efe8c766a267d4b34c2af2fdfed81f410bb602c0e9e2aed

Score
10/10
agentteslacollectionevasionkeyloggerpersistencerezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.microtechlab.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pune@123

Targets

    • Target

      SIGNED AND STAMPED INVOICE.exe

    • Size

      461KB

    • MD5

      1319cf2f252ccac65fc3d468b487593d

    • SHA1

      ba35e5badeaac9233605ca750849dd3ee324413a

    • SHA256

      0843dfe5e6b3266770393c129939c4fc85db09ee36dd51696fbc711a3b556460

    • SHA512

      025a7cb074dbb315bb9e3366cd71a1cced563a8e17143d1cdc51d20eeb0a73d374fbc1f5f044eba2edc111a2c1970654060b55f6c1c09b8331ca9e887e4561bb

    Score
    10/10
    agentteslacollectionevasionkeyloggerpersistencerezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks