Overview

overview

10

Static

static

ENQUIRY FO...HT.exe

windows7_x64

10

ENQUIRY FO...HT.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b64d50e4cdd9324e9ebba004b4b923d88bc82d9161b92c6113ee80034559951

  • Size

    380KB

  • Sample

    220521-nhdjkaghcn

  • MD5

    be90593cf28df43f782c2c664a166a29

  • SHA1

    cb19d004621fcad1567e59cd66f6e39595a0c947

  • SHA256

    6b64d50e4cdd9324e9ebba004b4b923d88bc82d9161b92c6113ee80034559951

  • SHA512

    4a882f71e5455ca72731d6fc335ffcf5448892448b8aa63178a7ab1f547209af6bc5823c9414670eecc32e0a6c46dbebc022873bc4ceffed15aeb8141b6922db

Score
10/10
agentteslacollectionkeyloggerpersistencerezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.drngetu.co.za
  • Port:
    587
  • Username:
    cso@drngetu.co.za
  • Password:
    WNFpR3FOMJ@6

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.drngetu.co.za
  • Port:
    587
  • Username:
    cso@drngetu.co.za
  • Password:
    WNFpR3FOMJ@6

Targets

    • Target

      ENQUIRY FOR GROUND LIGHT.exe

    • Size

      428KB

    • MD5

      771faddf9ed0dafb008704e0364778b2

    • SHA1

      1f3285e5a0c7d879b043650e59ed56e2567e6fa5

    • SHA256

      26b0c60003a6b8c46327c68cffd48e719ae1cfffe87d119dbec59e14d23a1ab8

    • SHA512

      2b78826737492a884faaedd04807e528e9da2c779b230470c97ff4b66e1c342bda46189230710c09df1d94019b35575cdded31b9bc3bfac35f748de9919c7505

    Score
    10/10
    agentteslakeyloggerrezer0spywarestealertrojancollectionpersistence

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks