Overview

overview

10

Static

static

Payment Copy.exe

windows7_x64

10

Payment Copy.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2feeb52cfdce6ef164006f224c520a93e800ed124b9e4bb57f0257153f0639d

  • Size

    408KB

  • Sample

    220521-n1ejksede2

  • MD5

    8d7a8a13d51b053d6e0255b75ceef9d1

  • SHA1

    cb08c89a9c1926ee3c7fef1892dc035cd557826e

  • SHA256

    c2feeb52cfdce6ef164006f224c520a93e800ed124b9e4bb57f0257153f0639d

  • SHA512

    52dda2a1fa774c7e4a51b0462034e05f70074b9901382742ec6527cfb74eab9b18b43ebc39c3e7ac22bf885f481617452f0a8b8ced36331f445f81fe28dec13a

Score
10/10
agentteslacollectionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    petersonhouston@yandex.com
  • Password:
    faith12AB

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    petersonhouston@yandex.com
  • Password:
    faith12AB

Targets

    • Target

      Payment Copy.exe

    • Size

      449KB

    • MD5

      2442896682f24bfd0ea5f237d45c95eb

    • SHA1

      64b0c3d4093a39bfe618f6da9c7fc6f0115a48c2

    • SHA256

      494f9dd6446590e875fa54a866cfc76c795f19722f2842d14d82590de96b6b68

    • SHA512

      757d54fe247067a4990b131276375fb51c3a3a3bda64236924ef54278e34fde2e92f6c2c8f9b9dd6cb145405482cbadae2d47544854acccb5d6e80b80a57c87f

    Score
    10/10
    agentteslacollectionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks