Overview

overview

10

Static

static

TT SLIP.exe

windows7_x64

10

TT SLIP.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b4f95fc3af9acb1caed7d0bb51574609ad60c58cb25e52445811bbc6bbffefc

  • Size

    217KB

  • Sample

    220521-byny1scfg6

  • MD5

    9ce6bbc944266e9bd0a402a05313bd1c

  • SHA1

    a398e3443f5678c79b22ef73fc499d52241503f9

  • SHA256

    0b4f95fc3af9acb1caed7d0bb51574609ad60c58cb25e52445811bbc6bbffefc

  • SHA512

    afaabb5656127ef6a7a78838d17e9d32be00eee548cb9ad2c45397fa9b705b426169db994218252e5555a760af119bc49b2e179564476fe7a8ecb3dfdd9f6bf1

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.qualitypulse.sg
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    10EWR0203486364

Targets

    • Target

      TT SLIP.exe

    • Size

      630KB

    • MD5

      6b94d92840160e9ecc9a9f808edc93f4

    • SHA1

      dcbce739ab926a184d2ebc995ff417c5772c4312

    • SHA256

      70072a6239488b071403cf29308652486727816236c455de356bbe13df67d3a8

    • SHA512

      6502f23e33bcb20c157a1461976a2275ce1eb6bcadcd960aa7837627929b016a78e3545045c90980efc002f0dbe4768b5a6ad8e089d4983dc07a1536fc4841ef

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks