Overview

overview

10

Static

static

db2cc72580...f6.exe

windows7_x64

10

db2cc72580...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db2cc7258075d37820ed3344f5dcc4784be1ac8cc33a6d02627ea3dccf06b5f6

  • Size

    381KB

  • Sample

    220524-1aatxsceam

  • MD5

    cacf618c8c192f885722c4c4386da202

  • SHA1

    08617dfd366a53afc487f48e447434d2a0cce058

  • SHA256

    db2cc7258075d37820ed3344f5dcc4784be1ac8cc33a6d02627ea3dccf06b5f6

  • SHA512

    a817cf4b9b4927bdd190aff7cece2a41de9eeafc6814f72d9e96c39340d0c27d9f64de4c94259c34e780897702701bd032aa82e98ba6f3b340dcea690247bea7

Score
10/10
agentteslacollectionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    tonyrikardo@yandex.com
  • Password:
    akachukwu123@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    tonyrikardo@yandex.com
  • Password:
    akachukwu123@

Targets

    • Target

      db2cc7258075d37820ed3344f5dcc4784be1ac8cc33a6d02627ea3dccf06b5f6

    • Size

      381KB

    • MD5

      cacf618c8c192f885722c4c4386da202

    • SHA1

      08617dfd366a53afc487f48e447434d2a0cce058

    • SHA256

      db2cc7258075d37820ed3344f5dcc4784be1ac8cc33a6d02627ea3dccf06b5f6

    • SHA512

      a817cf4b9b4927bdd190aff7cece2a41de9eeafc6814f72d9e96c39340d0c27d9f64de4c94259c34e780897702701bd032aa82e98ba6f3b340dcea690247bea7

    Score
    10/10
    agentteslacollectionkeyloggerrezer0spywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks