Overview

overview

10

Static

static

BF0SGkmt7ZN2o4u.exe

windows7_x64

10

BF0SGkmt7ZN2o4u.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7741d9cf1339e3fdf86ae1617e8aeb509a8e364e22ed0e7d77f3538063971639

  • Size

    607KB

  • Sample

    220521-n5z13shghn

  • MD5

    62c4cd592090f900bb773602de403c75

  • SHA1

    0e5c8748b0bc0208aa59c00ad8c6ac66923ac6cd

  • SHA256

    7741d9cf1339e3fdf86ae1617e8aeb509a8e364e22ed0e7d77f3538063971639

  • SHA512

    5f9798292dac3c2b68038aab74e155eaff684fff8aa79c0a133bef334ef7cb1cf81dbaf0520402cc8b9e051ff613c813a9c8f30dcd812f508f6bdb58747ffdb1

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.flsrnidth.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    L%_#$f{LfI?^

Targets

    • Target

      BF0SGkmt7ZN2o4u.exe

    • Size

      830KB

    • MD5

      f986110a13038171184dbf858669a6de

    • SHA1

      565d73cde90400f4366570ae6297f51361ee14f0

    • SHA256

      afb7dcf65128c644b28c6b29611d9766c6d41797b6d4edb189ac1e3dc0effc77

    • SHA512

      1f994738f6b7dd742486bf5752c9a2a1c7850cd94ef2227dfb5fca88d4b9704d46b986ad33be901b91c3292c76da1123146bd1d400befcdf231f521c3c1e782a

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks