Overview

overview

10

Static

static

PAYMENT COPY.exe

windows7-x64

1

PAYMENT COPY.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    PAYMENT COPY.rar

  • Size

    564KB

  • Sample

    221012-rzpvpsffg5

  • MD5

    c961c8c45dda5a57576cb42396afa968

  • SHA1

    6f2191d388a5fddd5390ef10955cac76b511c8e9

  • SHA256

    82f79f7b3e96b58f4b55169d23a97bcb2414d241ed5e6ec11d003e050b8aae67

  • SHA512

    8e09701744084ef050925e38f72d2f0b31921cd546a0be96e59a5d101701468a31a95b02add4f152417ea0dff0a6c66a61e286360de1f24efc9947d485351e01

  • SSDEEP

    12288:pdu8n6Yb8QJzPWzUlzlvIF87Rxie4kX7LapZQrtIo4B5hoCthQ71J:azYb8EOz0zegxrXXtB4BrrY/

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      PAYMENT COPY.exe

    • Size

      675KB

    • MD5

      3c376cc6d362ab9a941478241250f1ff

    • SHA1

      b6cb95becd8f1bcae613a2e246882295ac52683a

    • SHA256

      37b4d94a45d2b219e534d24c47fb425415096e31b23c412caa79783a53ba37c7

    • SHA512

      672b9aa9b8d825848fe1b0531bdab08b6705e67f8b770e9d04012a4e3fb009d768a30d3f6eada6976d76136d2bc355612af90b468510ab1a064707597b256c23

    • SSDEEP

      12288:3fuvwWauu2iNaLsnKf3N3WzO11dNYaJHu1dDMemQxc6qbWADqjJ5nQca4SgaHag5:ywBuu1QoK/D1ZGFMKc6qbYjrba4J

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks