Overview

overview

10

Static

static

advance payment.exe

windows7-x64

10

advance payment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    advance payment.exe

  • Size

    566KB

  • Sample

    221018-hzyceafbdr

  • MD5

    05c01ddc8eb7af8cb3c49dfe101db3f9

  • SHA1

    689e211a6e4cdabf6dcd2b0cd20da68c093c6bdb

  • SHA256

    90b01e99ca3dc23e4902fb8ea15d61aa872208b47f5ff545561688f19729bfb6

  • SHA512

    9a388b483f4a860bcc26ac88925dd820d2e8dd9ebd439118692f978f8375116c7ac10c7d717c6ec36c0dddecceed1e015d0aa81e6f366a9e92e6d554956df027

  • SSDEEP

    12288:kB+96l1M2VAIQw1CUHZS2XYgn3A90vvJYRijFo4DViOSkNMSh0:kB+9SLQSHZS2Xhn35hy

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.qualitysolutions.co.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    9873335231

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      advance payment.exe

    • Size

      566KB

    • MD5

      05c01ddc8eb7af8cb3c49dfe101db3f9

    • SHA1

      689e211a6e4cdabf6dcd2b0cd20da68c093c6bdb

    • SHA256

      90b01e99ca3dc23e4902fb8ea15d61aa872208b47f5ff545561688f19729bfb6

    • SHA512

      9a388b483f4a860bcc26ac88925dd820d2e8dd9ebd439118692f978f8375116c7ac10c7d717c6ec36c0dddecceed1e015d0aa81e6f366a9e92e6d554956df027

    • SSDEEP

      12288:kB+96l1M2VAIQw1CUHZS2XYgn3A90vvJYRijFo4DViOSkNMSh0:kB+9SLQSHZS2Xhn35hy

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks