Overview

overview

10

Static

static

10

SOA.exe

windows7_x64

10

SOA.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f8baf9ed7a5a0a111ee258ff480db7904a0df836310fac26aa2820f4eb9d18ca
  • Size 464KB
  • Sample220521-n456psefc4
  • SHA256 f8baf9ed7a5a0a111ee258ff480db7904a0df836310fac26aa2820f4eb9d18ca
  • MD5 SHA1 SHA512
Score
10/10
agentteslasnakebotcollectioncoreentitykeyloggerrezer0snakebotspywarestealertrojan

Malware Config

Extracted

Family

  • agenttesla

Credentials
  • Protocol

    smtp
  • Host

    us2.smtp.mailhostbox.com
  • Port

    587
  • Username

    [email protected]
  • Password

    mpjw2013

Targets

    • Target
      SOA.exe
    • Size 512KB
    • SHA256 229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3
    • MD5 SHA1 SHA512
    Score
    10/10
    agentteslasnakebotcollectioncoreentitykeyloggerrezer0snakebotspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • SnakeBOT

      SnakeBOT is a heavily obfuscated .NET downloader.

      snakebot

    • AgentTesla Payload

    • Contains SnakeBOT related strings

      snakebot

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks