Overview

overview

10

Static

static

Purchase O...oc.scr

windows7_x64

10

Purchase O...oc.scr

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b90f111bc8c7fae466e51e54f57aaefe3b776c0e4044f0d0f118d0e558f82f5

  • Size

    532KB

  • Sample

    220521-nc3aqsdea9

  • MD5

    7beaa00fb91f63289b5218b40e1cc9eb

  • SHA1

    aa1346f856c72ba57a912971c39f042e058b2594

  • SHA256

    4b90f111bc8c7fae466e51e54f57aaefe3b776c0e4044f0d0f118d0e558f82f5

  • SHA512

    b6f25c229e162dba454fec7f91a1e90f19a4e5d08502b3e872d9315f11f4ac872bbd7a769a4214ec657488b91aecc778535ed16c93f214b5272cb3ca7b1f633f

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.alfadlytcc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    A$P@ss2022

Targets

    • Target

      Purchase Order Doc.scr

    • Size

      796KB

    • MD5

      8edcfe92ce92808f800bef12341052e8

    • SHA1

      412a5505293f3e2d6d41340af08b0a192456b7ad

    • SHA256

      0193ff4bf0658fc5b1bfa21d0fde437f8ebd5c0e2bb81227f71d75de8d076c08

    • SHA512

      5c6237bb67779fbeba2e279e190544e574595a2258507d3acc22d710cac7e80566540e31f14c0dd8ed2a4470257745ca3c3763419048c2c64af3c0db28928881

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks