49315131d6f74bfc7f35ea28265eeba7a1672aa934dd4605cd07d3502954b387

General
Target

49315131d6f74bfc7f35ea28265eeba7a1672aa934dd4605cd07d3502954b387

Size

514KB

Sample

220521-pxd93sbdbl

Score
10 /10
MD5

5fe9dcca4cfd2f33c37c632afeeac7c4

SHA1

ca2b3a83a273675e69b54276ba1b30adde90fce7

SHA256

49315131d6f74bfc7f35ea28265eeba7a1672aa934dd4605cd07d3502954b387

SHA512

4370fa07f2355263ae3a9c6c677bb9aef8f41a78acad782807726bf0609891802b9b6513a856b9a7d80f92edf832eb1e47700bd23806a9fc10d025727937cfcb

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.aneeqllc.com

Port: 587

Username: marketing@aneeqllc.com

Password: gofast99Tu
Targets
Target

opioooo.exe

MD5

781af3413205e9e6bcee1f19ce07da63

Filesize

533KB

Score
10/10
SHA1

ee139062d39986041356dc9fd17e917c28387e7b

SHA256

361df840f755828b47108104d9da4a9614d9c961f913c89c12027799150568df

SHA512

54b806a18825e1989df37630264071db542e0df26e94b82510b96357df1e92b0d31525e591298663a803e0dcf63af52370e1744cc70d264402243cae088d232c

Tags

Signatures

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

  • ReZer0 packer

    Description

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    Tags

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
      Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation