Overview

overview

10

Static

static

REMITANCE ADVICE.exe

windows7_x64

10

REMITANCE ADVICE.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3f412827de9746af6ee41fd134ab53734ce666f9786fec6020e73090b39d3fb

  • Size

    576KB

  • Sample

    220521-bnjljscbe8

  • MD5

    2cac34bf135e08bb284110c17405bff9

  • SHA1

    47bbcb3a5e3b08344824e2c68a653f8ec8734ae5

  • SHA256

    d3f412827de9746af6ee41fd134ab53734ce666f9786fec6020e73090b39d3fb

  • SHA512

    423bbc010bc6cb13a2ed2be9452c200743ece18a928aabeb5e93eddc8feedd457926b6052fbd76047be8a77268640f57de07344f92b6a14d311e9f808f21a6e0

Score
10/10
agentteslacollectionevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.pptoursperu.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mailppt2019-

Targets

    • Target

      REMITANCE ADVICE.exe

    • Size

      719KB

    • MD5

      de64989943967579858fe30c6c10e969

    • SHA1

      00a162896289a64b0488d9a46bb7888bac5b7a0f

    • SHA256

      0eb506623215bfd28e3f1b9f7f34b0fc254b0a2fe8a91f5cd0a62f26bd739169

    • SHA512

      0df8a190958bdb15d0b000541ea31f4bcc5f1e7bb85cbe129d9438d763e5e8c9d056e4a32f33e7a42891fe1b0589e40588783a3d5ae6585057f1fbae232c42a1

    Score
    10/10
    agentteslacollectionevasionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks