Overview

overview

10

Static

static

10

7665_16 as...ng.exe

windows7_x64

10

7665_16 as...ng.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb7be1f04c16f6137569fe31f48f2030810d07eb910a6e63f431a6cc9aaf90f1

  • Size

    167KB

  • Sample

    220521-pdcbdaacdn

  • MD5

    98b612eb13c695dc4fd7a594fd796dc8

  • SHA1

    8b2cc4d1b5407f68793031c808e8eee41217f565

  • SHA256

    cb7be1f04c16f6137569fe31f48f2030810d07eb910a6e63f431a6cc9aaf90f1

  • SHA512

    371c09009bb1ebb75a1d80291ce7d4711505f40135fe2e9f8f0641e056caacb1019f02d884b7fff19a1bef08827a009d116fbb8a85728383c84937e3c55a60ca

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      7665_16 asean restorer - spec 602 - alternator cleaning.exe

    • Size

      280KB

    • MD5

      240a166a2540719b014e8d305823afd5

    • SHA1

      b89f2ca94eb3f13a3e2c81ed789b534d8ae426aa

    • SHA256

      d643658a2f8632c92fcb27ce0df6b1dc5f70719fc24776ec6b0321ffb280ce17

    • SHA512

      4ee597c44373f29106c9876e12daa1079da88fa85065a7def281b4b98d3ee5cf0192c7ac2138f3634e11cdfdae2196429748a13b423a11679587c399653caad7

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks