Overview

overview

10

Static

static

bef9680926...48.exe

windows7-x64

10

bef9680926...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bef9680926b32f2252d5a8b193329833a86d0eea9ea2900a2abc3bc863bb0448.exe

  • Size

    574KB

  • Sample

    221206-nnvp2age61

  • MD5

    271925836d2072b74f62a1f30f335fb7

  • SHA1

    dc25c270c6dccc9bde0d27474070031cb214e2f0

  • SHA256

    bef9680926b32f2252d5a8b193329833a86d0eea9ea2900a2abc3bc863bb0448

  • SHA512

    9437ec0bd3c5adbe5fc1eec79a9162262dd32fbfcb9308f9cb9b12d1b95159b0bddd77aa30481462feda70b5f232542eb880eda7308e020ed05c5ea987caaefa

  • SSDEEP

    12288:azZB1xM76UBvWnBHRJpcxSQBSAB9WfdLQ3TzAh+n0m07wZJ53c6z9J+tVb7k5:azZBA76UBmJeTqO3TUhY0m07Q53c6z91

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.electrobist.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cAP&5)Y*cPUE

Targets

    • Target

      bef9680926b32f2252d5a8b193329833a86d0eea9ea2900a2abc3bc863bb0448.exe

    • Size

      574KB

    • MD5

      271925836d2072b74f62a1f30f335fb7

    • SHA1

      dc25c270c6dccc9bde0d27474070031cb214e2f0

    • SHA256

      bef9680926b32f2252d5a8b193329833a86d0eea9ea2900a2abc3bc863bb0448

    • SHA512

      9437ec0bd3c5adbe5fc1eec79a9162262dd32fbfcb9308f9cb9b12d1b95159b0bddd77aa30481462feda70b5f232542eb880eda7308e020ed05c5ea987caaefa

    • SSDEEP

      12288:azZB1xM76UBvWnBHRJpcxSQBSAB9WfdLQ3TzAh+n0m07wZJ53c6z9J+tVb7k5:azZBA76UBmJeTqO3TUhY0m07Q53c6z91

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks