Overview

overview

10

Static

static

4195c8096b...15.exe

windows7-x64

10

4195c8096b...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315.exe

  • Size

    1.1MB

  • Sample

    221207-qbhk2sab3s

  • MD5

    57bbed4a1aafc1b18b57fd359e2a2109

  • SHA1

    770f6b6a2af7005dc56e6e4afa0beb074de0d245

  • SHA256

    4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315

  • SHA512

    5feeb92d33b694fda800637fd97598a472c3a780f1d71851720cf7cfe99c9e5b517b7f366ed63958fc2e9042e741fdd03fd0f92cf5575a7b1b38c6f0a0500100

  • SSDEEP

    24576:+zR2gh/awpCqT1DmwZf9Xirkh/b3s5NR/jkVoMCZ+d5Hu2Dz:+zR5h/dP3f50k0R7yCZ+d5J

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    nas@mishaship.xyz
  • Password:
    $bSl(ZB5

Targets

    • Target

      4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315.exe

    • Size

      1.1MB

    • MD5

      57bbed4a1aafc1b18b57fd359e2a2109

    • SHA1

      770f6b6a2af7005dc56e6e4afa0beb074de0d245

    • SHA256

      4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315

    • SHA512

      5feeb92d33b694fda800637fd97598a472c3a780f1d71851720cf7cfe99c9e5b517b7f366ed63958fc2e9042e741fdd03fd0f92cf5575a7b1b38c6f0a0500100

    • SSDEEP

      24576:+zR2gh/awpCqT1DmwZf9Xirkh/b3s5NR/jkVoMCZ+d5Hu2Dz:+zR5h/dP3f50k0R7yCZ+d5J

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks