Overview

overview

10

Static

static

ordinului ...ă.exe

windows7-x64

3

ordinului ...ă.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ordinului de plată.exe

  • Size

    300.1MB

  • Sample

    221207-kn6kraed4z

  • MD5

    b94505cfbac872985e054b346cc7d2e4

  • SHA1

    560a9a480382549b216d8b0c6dd2486d45e9c12a

  • SHA256

    030e5a3cc44ffe96ca6813435d259d7bc62d015474856458690d3b2d5bff3987

  • SHA512

    08c894c3bb313bc179d73eb3e6cd4c12d70b0535c8f4591223d70797795fc8dc4d8d658f9c46bbea55375ce208dacdbaed0d421e8ca669410e55e63c7f9d41ab

  • SSDEEP

    192:ruasZ144/rLlQukYzHsjgRzyaMxxxlK4QzwU9zut:ruas/BrLlQukCBwk4QzwU9m

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Targets

    • Target

      ordinului de plată.exe

    • Size

      300.1MB

    • MD5

      b94505cfbac872985e054b346cc7d2e4

    • SHA1

      560a9a480382549b216d8b0c6dd2486d45e9c12a

    • SHA256

      030e5a3cc44ffe96ca6813435d259d7bc62d015474856458690d3b2d5bff3987

    • SHA512

      08c894c3bb313bc179d73eb3e6cd4c12d70b0535c8f4591223d70797795fc8dc4d8d658f9c46bbea55375ce208dacdbaed0d421e8ca669410e55e63c7f9d41ab

    • SSDEEP

      192:ruasZ144/rLlQukYzHsjgRzyaMxxxlK4QzwU9zut:ruas/BrLlQukCBwk4QzwU9m

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks