Overview

overview

10

Static

static

blessingzx.exe

windows7_x64

10

blessingzx.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    blessingzx.exe

  • Size

    704KB

  • Sample

    220522-fzxprsfee9

  • MD5

    2bbd2bf04a6bf7ec2715d128c6a6dcae

  • SHA1

    6f8fede1ba71eed100a45008e7f39cdee20c61fa

  • SHA256

    55c82f009062044f6d89e82b9b4a6c889b3b3379114ebc38e14d4c5904b99779

  • SHA512

    5a4c63f5d3e1e7b6bbc2246cd51318f784c4a652aa36855003c1d0f9932074f3068cc1f4315c72fec64e709d6791cdc6509480b63ed6ca7d0ec29b5e803584ef

Score
10/10
agentteslacollectionkeyloggerspywarestealersuricatatrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.utt-ae.com
  • Port:
    587
  • Username:
    adonato@utt-ae.com
  • Password:
    #yX#rGyo7

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.utt-ae.com
  • Port:
    587
  • Username:
    adonato@utt-ae.com
  • Password:
    #yX#rGyo7

Targets

    • Target

      blessingzx.exe

    • Size

      704KB

    • MD5

      2bbd2bf04a6bf7ec2715d128c6a6dcae

    • SHA1

      6f8fede1ba71eed100a45008e7f39cdee20c61fa

    • SHA256

      55c82f009062044f6d89e82b9b4a6c889b3b3379114ebc38e14d4c5904b99779

    • SHA512

      5a4c63f5d3e1e7b6bbc2246cd51318f784c4a652aa36855003c1d0f9932074f3068cc1f4315c72fec64e709d6791cdc6509480b63ed6ca7d0ec29b5e803584ef

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealersuricatatrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • suricata: ET MALWARE AgentTesla Exfil Via SMTP

      suricata: ET MALWARE AgentTesla Exfil Via SMTP

      suricata

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks