Overview

overview

10

Static

static

Urgent Inq...Q).exe

windows7_x64

10

Urgent Inq...Q).exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c293265e69a4e781948e0991d0f99c1c22c04d33c1405c3fa1fe20733952678e

  • Size

    414KB

  • Sample

    220521-n1frmsede3

  • MD5

    790a33711bf26660931f94b405f67665

  • SHA1

    8e8f1898575220a8d01cc1796d8390af15b0d707

  • SHA256

    c293265e69a4e781948e0991d0f99c1c22c04d33c1405c3fa1fe20733952678e

  • SHA512

    f690f41988d74566d1d8464a2fb455977ecf84d4d35e7f8d15e92461df2bd3e1d6dc7ddf4d854d65945dd09a4264b67eee042cbadaf40d74553461ab6b1b820d

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    spar@interiorsidea.fit
  • Password:
    71c7eb1f8ba

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    spar@interiorsidea.fit
  • Password:
    71c7eb1f8ba

Targets

    • Target

      Urgent Inquiry (HEC RFQ).exe

    • Size

      622KB

    • MD5

      344711a513dc11fb20626acfe0a702b5

    • SHA1

      585720af846999cbde9e0caa6e79fae842495470

    • SHA256

      5436a7bcc453550473db1a6e439538bd0ba7c6a87577f450642dab6da0f33263

    • SHA512

      c3fd35bc091a5dafadab197b8ad1f6c5e9f22eaad44e92d5bb0c3664bee8e91b49ff78e40634df35aa7d7698d83e23383359f3233e93b0f2f06f3ca79bda3981

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks