Overview

overview

10

Static

static

Payment_Advice.exe

windows7_x64

10

Payment_Advice.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dd988b13c8f53beb75b2cfe1af636c0293a5c2d504696301184616a821cfaba9

  • Size

    450KB

  • Sample

    220521-cfj3sadgf6

  • MD5

    35e427e11fd4216dcb459ab924d7f3ee

  • SHA1

    44099af6ea68870a57cf048d8526ae5b8a0524b7

  • SHA256

    dd988b13c8f53beb75b2cfe1af636c0293a5c2d504696301184616a821cfaba9

  • SHA512

    416f4e2b39267d54882d179e252cfa9f1485f101f9bff972b945aeb5f193ae9b8fe4b711d932b9bf65ae26a63610f052af11ea5a5bf43b4e6edd81991a57d861

Score
10/10
agentteslacollectionevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.tolipgoldenplaza.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Golden@#$2019

Targets

    • Target

      Payment_Advice.exe

    • Size

      468KB

    • MD5

      e6f94cdf7f585bfcb5dd2579a88a1add

    • SHA1

      6f772d33c9af553712113a316c8e37e8d7447e72

    • SHA256

      011a4b06a1a31fec0e9d5a013b9721f4e30f0ec963d07c42cb1d0e41c30df389

    • SHA512

      f0ec99f30ec44519a214f62179fd4856cc0b2e814e09909d82c2504a26fc0c25cf6ba70ce4c0055ad8808dc0ea11de178c29e7adcb253776aeb54097502c1905

    Score
    10/10
    agentteslacollectionevasionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks