Overview

overview

10

Static

static

5895a31246...f7.exe

windows7-x64

10

5895a31246...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7

  • Size

    476KB

  • Sample

    221130-wlsrnafc3z

  • MD5

    2f2984690e83994f56545ed93bbfe557

  • SHA1

    aa3a0b86b160f19072a2db2afa186f761a9569eb

  • SHA256

    5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7

  • SHA512

    ef1f0840522e32fd6d94fee8182e64d0018032b87105cc01e5c270d7cd6c63e4643b827d81f5e6e684358a78f6acf1c6526f40cdb9212b100fabc06fc38d3159

  • SSDEEP

    12288:gYR/SQVieUH3JagG3R/5+MQLOtD3lfAZnrehQF:XR/SQVi7H3JagWMONVotri2

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.allenqers.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    stanstan22

Targets

    • Target

      5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7

    • Size

      476KB

    • MD5

      2f2984690e83994f56545ed93bbfe557

    • SHA1

      aa3a0b86b160f19072a2db2afa186f761a9569eb

    • SHA256

      5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7

    • SHA512

      ef1f0840522e32fd6d94fee8182e64d0018032b87105cc01e5c270d7cd6c63e4643b827d81f5e6e684358a78f6acf1c6526f40cdb9212b100fabc06fc38d3159

    • SSDEEP

      12288:gYR/SQVieUH3JagG3R/5+MQLOtD3lfAZnrehQF:XR/SQVi7H3JagWMONVotri2

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Drops file in Drivers directory

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks