Overview

overview

10

Static

static

SecuriteIn...65.exe

windows7-x64

10

SecuriteIn...65.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

  • Size

    929KB

  • Sample

    221129-p2cxtadc6x

  • MD5

    f64f729e0ba974c578afaac25665e067

  • SHA1

    d1225322fd5f16eb18a90ec4a4b007a010e2d51a

  • SHA256

    680f16527c5dc7e7e32bb27b99dcbc85c75282d853cb9a27c186963dae883d2e

  • SHA512

    6bf0f4a2567736cdfa5e422e23f1f43a593699a1276654264a619e2f1b4690af911e04508d0928c3a84ea658c022dc4b44f4f0467254c72bb92191e212e029c8

  • SSDEEP

    12288:kBuqU+PCH5W8IgKprPRibKTh6SoqZpK3tUjjAK7nYbSuSmFbWNHrDdzoa1cfN:Idrlf6SoqbK3InYUJDdEPf

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5796842243:AAESM2w0ubqts6zEsE_xN4PZ56pLfxQ9e7M/

Targets

    • Target

      SecuriteInfo.com.Win32.CrypterX-gen.12778.11165.exe

    • Size

      929KB

    • MD5

      f64f729e0ba974c578afaac25665e067

    • SHA1

      d1225322fd5f16eb18a90ec4a4b007a010e2d51a

    • SHA256

      680f16527c5dc7e7e32bb27b99dcbc85c75282d853cb9a27c186963dae883d2e

    • SHA512

      6bf0f4a2567736cdfa5e422e23f1f43a593699a1276654264a619e2f1b4690af911e04508d0928c3a84ea658c022dc4b44f4f0467254c72bb92191e212e029c8

    • SSDEEP

      12288:kBuqU+PCH5W8IgKprPRibKTh6SoqZpK3tUjjAK7nYbSuSmFbWNHrDdzoa1cfN:Idrlf6SoqbK3InYUJDdEPf

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks