Overview

overview

10

Static

static

Terms & Co...2).exe

windows7_x64

10

Terms & Co...2).exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48d4642b3d952f7222760f2a90d280ad5a80da015fce0a6d94525fd62c213ae4

  • Size

    388KB

  • Sample

    220521-dkx1wafha4

  • MD5

    a7540be40477e1cea4cf4eda31b035e4

  • SHA1

    80fa4b81e5fe2979241a82c8d2f6ce070dc3922a

  • SHA256

    48d4642b3d952f7222760f2a90d280ad5a80da015fce0a6d94525fd62c213ae4

  • SHA512

    230f7ff8673d8502dcfb1008caf474dde44baffcc832c43297a500b5f34ba062dfa169783de6e4b1b9dffbe67ad9e2bfa896e475ec0cf70c5c50fd1b23a24e50

Score
10/10
agentteslacollectioncoreentityevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.hotel71.com.bd
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    9+^va&phP1v9

Targets

    • Target

      Terms & Conditions.pdf (2).exe

    • Size

      446KB

    • MD5

      6bdd9c15243bd5b8709b87b7ba10b3a9

    • SHA1

      780f690b92f29296254f00b9f1958c2359991ad2

    • SHA256

      2580575e95648d76aed0be387fbe6423ef72639b8aaa9e1ad84ebc5b74bcf7b5

    • SHA512

      46a0f1f8a1c6d6cfbea8c287cd9f06fb44e987f8c452a2e5f99da852d871de1552a25eb7d79c794c817e16c7917d3e39383046173699c1fcc07f53dec0ec5cdd

    Score
    10/10
    agentteslacollectioncoreentityevasionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks