Overview

overview

10

Static

static

APO-074787648.exe

windows7_x64

10

APO-074787648.exe

windows10-2004_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1e55d9bc9975c6df2811c6888d3c12273000f56ccb2de4b27e759996efa8ce8

  • Size

    574KB

  • Sample

    220521-nbpcgsdde2

  • MD5

    6df534f8d9c8fad449e3281e0f538c07

  • SHA1

    457c6d00b93c982d0e8028f26d5015b3b0e8abf0

  • SHA256

    a1e55d9bc9975c6df2811c6888d3c12273000f56ccb2de4b27e759996efa8ce8

  • SHA512

    36f2b621bcf249f10076bd652af8aee45ea017380bb02c15c5598a68f171cb317bb48ecfc13f6608d3452faa1381d97c4300956677c21223b1ea16aff4e0891d

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.clrakmheu.com
  • Port:
    587
  • Username:
    svenvangermain@clrakmheu.com
  • Password:
    GDXAP$m2

Targets

    • Target

      APO-074787648.exe

    • Size

      633KB

    • MD5

      fe7198b7b35c587907c7ba606030d496

    • SHA1

      54facfc747474a4f6948df9f42e80eb2a0063f36

    • SHA256

      88064a6ead6d60e5bc743ec981c2d608b79d357d46bf2ec39a05fa3831fc436b

    • SHA512

      d3a741960d49127482f02c092dacb75636018604746f3beda7c7fa53e0da68d36c3728832476f9ebf9795837cff07bb9a09e5d6f600e7374217241142b15304e

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks