Overview

overview

10

Static

static

MEPS-42.exe

windows7-x64

3

MEPS-42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MEPS-42.zip

  • Size

    617KB

  • Sample

    221129-qms6xscg27

  • MD5

    ea68e4860c398cd67886be2666b22d5a

  • SHA1

    99267ed251570e7fc790d633fe2208f67b11d2af

  • SHA256

    131010bcbfe67d25b6a6d64eb7a987b8796dce996e9d4019d9a035bd732a055e

  • SHA512

    932c514e3a0e8223e35e106e195d2d39b50f468981575b36b3324ac65e4f2c7306c72bd6ccce78033d582df22dd246bf1aaaa59dcea2b6c5703456c0a47a2761

  • SSDEEP

    12288:3WAVnjxWJbTKzGkqyFizl+M4kLvHGOUw+3OFml/x2ZCEim:mAJNWJbTGGTRpusvHGoFmlx8im

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.chroasia.org
  • Port:
    587
  • Username:
    secretariat1@chroasia.org
  • Password:
    Bhatia_rl123
  • Email To:
    djsmiley0055@gmail.com

Targets

    • Target

      MEPS-42.exe

    • Size

      779KB

    • MD5

      d7ef3266f37151f64ba446c1edcdd779

    • SHA1

      1b7c6b50f3b85943ce13eb1bc3c00de89dc9b76f

    • SHA256

      9fafe0f757cd03424b2314164d0ddcc120a75b38d69e41b8350c4f1b6c6092b7

    • SHA512

      41eea8d14f92995339ed0451d566f36946c73f15c2beeed0e18d99887a65483849807b58dca4e32fd675284637fe25ed184892463adf3b2556e7c9a92fba987d

    • SSDEEP

      12288:VLVDcgFr5cE8LHWQN1bTK5GaqqFWzleM4k/BHGOUY+NGO/SEdRMA/LyzIPPPu6gt:wjvLLbTaGVjpOiBHGCi9/LkInst

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks