Overview

overview

10

Static

static

Bank Receipt.exe

windows7_x64

10

Bank Receipt.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9960f17788ddeb3efe6a3718a9331e682e628047830d047eec663564eaa829bd

  • Size

    359KB

  • Sample

    220521-cybt5aeff5

  • MD5

    e8268f8210663b625dedf8b8ea33c961

  • SHA1

    275f652f48a8a55cf10c819d5d401c5d4e22256f

  • SHA256

    9960f17788ddeb3efe6a3718a9331e682e628047830d047eec663564eaa829bd

  • SHA512

    927b8d26d4fe5d44a3b0a489cb77a5231a3c047068931556647765229b7b585da3029d984be6d36b643088e33955fa1b2e5f4b6041e6b2f3690cd9f6b9b08e95

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.bapipl.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Bharat123

Targets

    • Target

      Bank Receipt.exe

    • Size

      413KB

    • MD5

      bd113a5daa8af5e21075b18dbcdaa675

    • SHA1

      1817166dc0110cff751a493a355ecb3272905ad8

    • SHA256

      1abdedc05bdc10f0cd2c772c7d13040f239f2c6238b720a4a0138c003fa1fc33

    • SHA512

      5504329026ec234636a8fc092a8be794573a5891e2a7b17f255dad1afd8df716675077d89f8d7338963c887c1da4cd0be6f4bdb2f3cd8dbc2011f942d5a58721

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks