Overview

overview

10

Static

static

KWIR000714988.exe

windows7-x64

10

KWIR000714988.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KWIR000714988.zip

  • Size

    627KB

  • Sample

    221129-qmsv6acg25

  • MD5

    780cc83e859f2f005571de1bfa2a1484

  • SHA1

    f35465219810c61847bb5e69facaec8f01773bcb

  • SHA256

    becc849ca8eac47d428b69c05c63d109385ac1a75b2fefce095aac90111fadfc

  • SHA512

    e7e7675950ab0caa42786aea5ae898605c437f7077cf9ac2b4d3746932bf05a96ad140f855676e9275251a7fae1afe07f647bc88b0bbe160c25a13058891a669

  • SSDEEP

    12288:IXFuld2ZE+5+2Ga3eL+605H0U6TNDrUwStW5TCvS+/giRHWUy2S:IXFod2ZD5+za3m0W7TxovMpCvh/9Ja

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.strictfacilityservices.com
  • Port:
    587
  • Username:
    accounts@strictfacilityservices.com
  • Password:
    SFS!@#321
  • Email To:
    guc850155@gmail.com

Targets

    • Target

      KWIR000714988.exe

    • Size

      789KB

    • MD5

      72c17e8d702de79f794fe16787a61098

    • SHA1

      18f51344f688db3979c55a6322f013269b4c308d

    • SHA256

      4513951a7d2bdb62b062c790f0c259d9f5854497b6e5e8ed0369d22197d1e856

    • SHA512

      09ca148f810649989cb89507848de48d55738f79bc301e4a7c8b2f3b52bc231b59aa79c15be126eb7c41a2d8801279792eb21a262b45e0503a8c93eca26fec43

    • SSDEEP

      12288:OKdsCbFr5cE8LHWy/SEdRMA/LyzIPPPu6gtFNDzUwSzWbTgvS6/IiTHWcb:7ovLB9/LkInstFxQvCngv5/1db

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks