Overview

overview

10

Static

static

signed_19272.exe

windows7_x64

10

signed_19272.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ceb1ec779efff156df9bca2e40e6f588207ea4f13a22b34195195cc5118315cf

  • Size

    429KB

  • Sample

    220521-cjxhaaeab8

  • MD5

    023e1d1aa82fa556ba6755bef0643f25

  • SHA1

    2f3222d3a7fec34557a227fd10d6bdffa34cf427

  • SHA256

    ceb1ec779efff156df9bca2e40e6f588207ea4f13a22b34195195cc5118315cf

  • SHA512

    de66ff5c678a1cd59c6f0c18e9b8aec7d444b5291b8ed529de16da37c8aac4bbc0fa2f70d0b1589a62892a75923d6ba5e68bf0f9dc9766e687c12cd80e58c730

Score
10/10
agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.pptoursperu.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mailppt2019-

Targets

    • Target

      signed_19272.exe

    • Size

      485KB

    • MD5

      29fe793a432bfccb58d667ffb3b32547

    • SHA1

      d7cce5305cb72e8f0ac1331c1178527e9936a071

    • SHA256

      3f4d8c350538601c60ddb8393b0c70904bbb81be0b59478770730dfe7a243e76

    • SHA512

      43cbb5ace671963742b3727407e03c223850e168b54a03ea3a48b9b51e68558e5289b1d70d994bfcc5788530fb079b7bc523f7d23a401cad734e4b00ebbe09df

    Score
    10/10
    agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks