Overview

overview

10

Static

static

aSaoUIk11KuTtCD.exe

windows7-x64

10

aSaoUIk11KuTtCD.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18772A250A515B1C7AFF2F0C633CCE9AE8034268ABE759DDBA85E9F0EB85140B

  • Size

    733KB

  • Sample

    221125-tngfasac87

  • MD5

    ef877507531f13375d8fd5c12c9d3510

  • SHA1

    8a01855b39df289cf3b42de34fb7f3aef8fa0d1c

  • SHA256

    18772a250a515b1c7aff2f0c633cce9ae8034268abe759ddba85e9f0eb85140b

  • SHA512

    2bdb7666ee7c443f18991f91d81d1361d4af6865fb21dee4da82428a5932a6a010dc61773a9a3905f0f8ef5ef786177ec48c3d98c7aca8e73425752df1720ff1

  • SSDEEP

    12288:Z1wqUMzEvCVfJG2/ct37tev1P0ecXivqDwUoV+p6IvHWLYCdjenu0X/sltVp:Zuq7zEvEt/ctLtev1P0ecoqMUolIvHWH

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.chinarcnd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mNQrnR%3

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.chinarcnd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mNQrnR%3

Targets

    • Target

      aSaoUIk11KuTtCD.exe

    • Size

      869KB

    • MD5

      afec564aed0802011db8e1ccf8f73d93

    • SHA1

      e72cc3f7a9ab5b3b9e609ee650d0a20dd4aa79a4

    • SHA256

      3c0aa4d30fb527f615c2bcc4ea18a379bf5c921f73fbf54fd78d4d8969dcf2e3

    • SHA512

      4df2ed2be260937fea5f7ddf9389fd6a9c8a884885432853a7caaccdb406f0e965790338845a128469165f94ea863f0980f961ea1d55f2709be80b3f686c0c0d

    • SSDEEP

      24576:vAfzEvi1/g3JteXFP0C40YeUw50vH2RjsBC:GQi1YJgrD/UwnQM

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks