Overview

overview

10

Static

static

#4WIa5.exe

windows7-x64

10

#4WIa5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    #4WIa5.exe

  • Size

    1.1MB

  • Sample

    221206-hnpacsdb79

  • MD5

    8c9cf2d7436c524449d3559a379a9b7d

  • SHA1

    519ff74cb97229a1b1fd7c5515b165cf30472e28

  • SHA256

    1e71e56913f6531c96445bc90b51d49e9a69574236d97b3c36ce99db4f9a9ee7

  • SHA512

    bc6ba9da565af95854e77e1ed10019f29c50f35ba438b0dfa4fc073f9cb1f5e80f6522cce11e8cf25c368e6ffed3173a531d1683d8d87278782ff2f8b8c351ef

  • SSDEEP

    24576:9g7yqlK/1FuZ7zNrQ5DQRQFs0TZ7yw+mD:u7yLDkVrQ5ysTB9JD

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1591373451:AAH6Q2mvjdA9146Wl0khv2-kuh-iTps2zjw/

Targets

    • Target

      #4WIa5.exe

    • Size

      1.1MB

    • MD5

      8c9cf2d7436c524449d3559a379a9b7d

    • SHA1

      519ff74cb97229a1b1fd7c5515b165cf30472e28

    • SHA256

      1e71e56913f6531c96445bc90b51d49e9a69574236d97b3c36ce99db4f9a9ee7

    • SHA512

      bc6ba9da565af95854e77e1ed10019f29c50f35ba438b0dfa4fc073f9cb1f5e80f6522cce11e8cf25c368e6ffed3173a531d1683d8d87278782ff2f8b8c351ef

    • SSDEEP

      24576:9g7yqlK/1FuZ7zNrQ5DQRQFs0TZ7yw+mD:u7yLDkVrQ5ysTB9JD

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks