Overview

overview

10

Static

static

708e198608...89.exe

windows7-x64

10

708e198608...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.zip.zip

  • Size

    473KB

  • Sample

    221207-z7xjhsgb88

  • MD5

    7e8ab81e9d6eb6b66a96e517bf87e4a5

  • SHA1

    b11448b322e61ce1d2878af231a52753c6fd421c

  • SHA256

    0d7cdcbf3e67c4055e817c680901e13ae4a3242ff641b476648a4a4d73165e93

  • SHA512

    581b510b576f1194212ffc8f8dd99125e421ee06cc914436fb76475f7f47dee9eb7395d6fe797d5f367b7f3ab93baac9851e104c498b0a9d296351653036629e

  • SSDEEP

    12288:jgqfsiqpr0AUZAtx+KA03aL2KOb5EYKwIjUYYde:jgxJx0zatwQ3a6KqEYKrjTme

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.godforeu.com
  • Port:
    587
  • Username:
    logs@godforeu.com
  • Password:
    O8k#Pz4sk:w_

Targets

    • Target

      708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe

    • Size

      928KB

    • MD5

      80b51e872031a2befeb9a0a13e6fc480

    • SHA1

      caebbab5349f57d92182ce56ef4bf71ea60226a7

    • SHA256

      708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089

    • SHA512

      12e9db89be76788d238f8a7f3114534b50b953b9ef619f84b0a124fba77f5e7d4aa00ae8f6ac3fdb16ecd1398950d6bdadfa43e9ec59b6d59667df5ac3d60879

    • SSDEEP

      12288:QieE+Q3mJyrf3iKXlrsfPO/l3Zn+aFpNUe2PPaEEaCh:QieE+5UrfvVg+Rd+afNH2PxEZh

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks