b92feb510c36837038c44d8ab317c2ea5634013cfb07b3ae1ef715ee5f17df58

General
Target

b92feb510c36837038c44d8ab317c2ea5634013cfb07b3ae1ef715ee5f17df58

Size

366KB

Sample

220521-ps8m5abbgl

Score
10 /10
MD5

b2922b85e9d15a3b573d008425e30fe4

SHA1

12ca2f6d516bb5363b5e40fa05a8dad12eaeccdf

SHA256

b92feb510c36837038c44d8ab317c2ea5634013cfb07b3ae1ef715ee5f17df58

SHA512

754087d92e5ac7bd5039a01a2d1ed40631eeef29dbf0388214931239e384e0b4f0fae0f330bc26a9129f810a0bea99d5b7bc186953b1948f83f1ec5d2d329801

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.microtechlab.in

Port: 587

Username: reports@microtechlab.in

Password: pune@123

Targets
Target

SHIPPING DOCS _234372.PDF.exe

MD5

a08a2bda9c51b2d5ca1e38435629cacc

Filesize

385KB

Score
10/10
SHA1

46107a6be4613e6c2d1f9e08af63de089417ea10

SHA256

6f4d9739f62d219787f6de178ab8f5fb29f317cac258c567d8d51cddea7aa4ac

SHA512

d3be87d66877a4cf71f2edccd0863c180630b979214c40170fa5585a878f5ea32efa2c10fbd7f6129362b672230978af32f9618cd71a69be3f087f3b56aaf411

Tags

Signatures

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

  • ReZer0 packer

    Description

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    Tags

  • Disables Task Manager via registry modification

    Tags

  • Drops file in Drivers directory

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
      Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation