Overview

overview

10

Static

static

PO105498-A.exe

windows7_x64

10

PO105498-A.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d7eaa18de0ac07919fb4bb3d9a60a08bc8b9402db503f79c2a45ab2f7708a22

  • Size

    398KB

  • Sample

    220521-nr678shber

  • MD5

    93794bbaedafcb88b56f61946d2d1144

  • SHA1

    06571dc3bf2bb71ddafe393f8e35b40269f033f6

  • SHA256

    6d7eaa18de0ac07919fb4bb3d9a60a08bc8b9402db503f79c2a45ab2f7708a22

  • SHA512

    49902f227a768a01d580dcff1155b40958fa27dee7b83f019e2285cb2d472366097f93538b2f0458dd34a821506ee20619f3883f74172f9c71804c3f819a1f94

Score
10/10
agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    wandony@intarscan.org
  • Password:
    church12@@

Targets

    • Target

      PO105498-A.exe

    • Size

      450KB

    • MD5

      096793783b7eb886bfeb88f388c639e2

    • SHA1

      b1c526d5f1d10fb36de24399834383f03d405adc

    • SHA256

      59c247e2d1a67db55ab379b24a75ddc95b02be753b3bf86e0865232f117a2761

    • SHA512

      aeb8f969f7e6f5c750e7b28894d94c71150b253549e27f21d94b3a163b70c9e482e0658e0207895d968c1d0aa145854883a317c31dd93b7df9d1de740ff6477f

    Score
    10/10
    agentteslacollectioncoreentitykeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • CoreEntity .NET Packer

      A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

      coreentity

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks