Overview

overview

10

Static

static

opioooo.exe

windows7_x64

10

opioooo.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49315131d6f74bfc7f35ea28265eeba7a1672aa934dd4605cd07d3502954b387

  • Size

    514KB

  • Sample

    220521-pxd93sbdbl

  • MD5

    5fe9dcca4cfd2f33c37c632afeeac7c4

  • SHA1

    ca2b3a83a273675e69b54276ba1b30adde90fce7

  • SHA256

    49315131d6f74bfc7f35ea28265eeba7a1672aa934dd4605cd07d3502954b387

  • SHA512

    4370fa07f2355263ae3a9c6c677bb9aef8f41a78acad782807726bf0609891802b9b6513a856b9a7d80f92edf832eb1e47700bd23806a9fc10d025727937cfcb

Score
10/10
agentteslacollectionkeyloggerpersistencerezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.aneeqllc.com
  • Port:
    587
  • Username:
    marketing@aneeqllc.com
  • Password:
    gofast99Tu

Targets

    • Target

      opioooo.exe

    • Size

      533KB

    • MD5

      781af3413205e9e6bcee1f19ce07da63

    • SHA1

      ee139062d39986041356dc9fd17e917c28387e7b

    • SHA256

      361df840f755828b47108104d9da4a9614d9c961f913c89c12027799150568df

    • SHA512

      54b806a18825e1989df37630264071db542e0df26e94b82510b96357df1e92b0d31525e591298663a803e0dcf63af52370e1744cc70d264402243cae088d232c

    Score
    10/10
    agentteslacollectionkeyloggerpersistencerezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Drops file in Drivers directory

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks