Overview

overview

10

Static

static

HSBCSWIFT ...DF.exe

windows7_x64

10

HSBCSWIFT ...DF.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bde3d8bc6098e4b9b6e35eab08be97a3699d465655350cf273528b337c3cb6ba

  • Size

    422KB

  • Sample

    220521-n1ty9sedf5

  • MD5

    8ecd6cb3a0e939f0f5a103657c146c4a

  • SHA1

    fe55f9bcc6b6f3d7c7d0631201df95a96497d96c

  • SHA256

    bde3d8bc6098e4b9b6e35eab08be97a3699d465655350cf273528b337c3cb6ba

  • SHA512

    d07645e9aabd13659a2a913ca733742fa48663b0e217206bd7b6d8f9a41a8a2faae96a350548a2d10900a913d6c8f24ef65b257b37bafce92328cb395557e298

Score
10/10
agentteslacollectionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    petersonhouston@yandex.com
  • Password:
    faith12AB

Targets

    • Target

      HSBCSWIFT ADVICE_0069700S.PDF.exe

    • Size

      477KB

    • MD5

      29634a7b0e1022814f0d4f64f3d6fa3c

    • SHA1

      22aa028a4b6a6a937fe930eab37d7ffd5fedc03e

    • SHA256

      d0e7ded6fed46be56e045d2c9e6df6cc6e439b5ed8503a13e0296e953917a0a7

    • SHA512

      71346230a139376d3fc0f5f74ec13f95373549aea77ed003efd9cf4ceb6e10662f34a6ea7ef82cd8f961e010f893b7caa0252cd25d1f746fdb4f8bc2ecf55f0a

    Score
    10/10
    agentteslacollectionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks