Overview

overview

10

Static

static

SecuriteIn...33.exe

windows7-x64

10

SecuriteIn...33.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.1328.4933.exe

  • Size

    986KB

  • Sample

    221126-t1c9eagf59

  • MD5

    9955a730e00b200bad30f767a58be114

  • SHA1

    4eaa66ecb5178bad27b98ac67c2a072f4373f933

  • SHA256

    69e4e4c4432c535212da7bd5f6918e558709b0d5b0776c656a1b9a00465ddc91

  • SHA512

    aae3f0c848779b020df0fc87ac87c1049b1ba34db8e1a6f8f9f9bb9233d4e8f321d32afc79b3b439008f46b6ec5a0211ef730994a557c6e2c4aab1a01822cbcc

  • SSDEEP

    24576:EChU376CYkFg/IyXtXHKqMvta/ao6zG22oMslDL3+bziHO1cMMppF:+2koXNH/cG9f6DL3+viicHpF

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.hostinger.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    lOg123@@

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.1328.4933.exe

    • Size

      986KB

    • MD5

      9955a730e00b200bad30f767a58be114

    • SHA1

      4eaa66ecb5178bad27b98ac67c2a072f4373f933

    • SHA256

      69e4e4c4432c535212da7bd5f6918e558709b0d5b0776c656a1b9a00465ddc91

    • SHA512

      aae3f0c848779b020df0fc87ac87c1049b1ba34db8e1a6f8f9f9bb9233d4e8f321d32afc79b3b439008f46b6ec5a0211ef730994a557c6e2c4aab1a01822cbcc

    • SSDEEP

      24576:EChU376CYkFg/IyXtXHKqMvta/ao6zG22oMslDL3+bziHO1cMMppF:+2koXNH/cG9f6DL3+viicHpF

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks