Overview

overview

10

Static

static

DHL_AWB_do...08.exe

windows7_x64

10

DHL_AWB_do...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c88315e2b28cc1c1f2524c161c5b28ee5d88a8d337e630fbfa565fd29135a8e6

  • Size

    691KB

  • Sample

    220521-n9f4rsaafm

  • MD5

    a4f6c7e7dfaf5d777b1d8fca61a33f09

  • SHA1

    e918948fd4e331d71b7294af91644045c735f4e3

  • SHA256

    c88315e2b28cc1c1f2524c161c5b28ee5d88a8d337e630fbfa565fd29135a8e6

  • SHA512

    7ae1cdac6089496682cb6200c526fa94ee73afe3776bfde812ce5e0b75074bad51beeae26d1ff749a955d39570e79472c937063d0d0bcd712352dd874171281a

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.tpts4seed.net
  • Port:
    587
  • Username:
    originality@tpts4seed.net
  • Password:
    krested123

Targets

    • Target

      DHL_AWB_doc_9882900_1010840355_10108.exe

    • Size

      851KB

    • MD5

      5b556cdfbc8f5564138af8bf10548657

    • SHA1

      92e61454e8141e7486644bed26d1d97481bf5437

    • SHA256

      c23108d7feb57c5b03d979f0d22dff7c6040d2e27f288e4e2812cb428ca24c2e

    • SHA512

      9b7329f8821de11ceaf3d40496cb1957f30f6e0f8c2c7da6c7805b7555e42bfe88a66651b6a797e141313f3623d6962ad65b22e549702c939b94a164c9ab1530

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks