Overview

overview

10

Static

static

Qualificat...ls.exe

windows7_x64

10

Qualificat...ls.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1247f59b35e73d7375c09a78f71f94a2437edd9d5229bb0d89bc065d10345e8

  • Size

    490KB

  • Sample

    220521-n2kf8ahfcj

  • MD5

    047225e60e9cd323866fdc0b21728ed8

  • SHA1

    993a9cf04cd330b09adbb9a5b57bbd175101ca2f

  • SHA256

    b1247f59b35e73d7375c09a78f71f94a2437edd9d5229bb0d89bc065d10345e8

  • SHA512

    40ce10c24a6ddd7c49b36940fcbcf420c4e10b6adf72340c5fe7f648d57441bed5161f6dd3f6610e60a33b12a497a2567fa6daec5a8eebca6356cec437faa562

Score
10/10
agentteslacollectionkeyloggerrezer0spywarestealersuricatatrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.1and1.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    $Hari@prasad%2020

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.1and1.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    $Hari@prasad%2020

Targets

    • Target

      Qualification details.exe

    • Size

      582KB

    • MD5

      5c7d36f450111107aff25b1d090062c2

    • SHA1

      752870a941f6145c37a49992dbf1a6decfd2292f

    • SHA256

      5a2965c63c2c74a0e8d06008ead3a82354dfd319468074823d5224a63e1a5c52

    • SHA512

      2d8968fb0380755929c08794b963e8c3aed8729121ca95db6c4c5b34c74e3ec8407a3bb31ac7d49b2a8b0367f7b0994f14d59da52b0912458a8699cf7984825c

    Score
    10/10
    agentteslacollectionkeyloggerrezer0spywarestealertrojansuricata

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • suricata: ET MALWARE AgentTesla Exfil Via SMTP

      suricata: ET MALWARE AgentTesla Exfil Via SMTP

      suricata

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks