Overview

overview

10

Static

static

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4.exe

  • Size

    954KB

  • Sample

    221208-nxz14shh44

  • MD5

    0ba9ab8a8886a1495ff3b381b891baf8

  • SHA1

    b4e05193c4697bde69b285bb102ced58ab739a93

  • SHA256

    d52464d74cb4b57f2337ac69dcac84dcb5081b3cfb7369f2a52eafe975aea12a

  • SHA512

    5712b1f2bcefe4f3828926751f98556bc376efa5bfcca22db29ce2163d8fde77119ae1500a96e47d31b8c6c21677f4172ebae6dcf369465fee0da6ea0b5fd870

  • SSDEEP

    12288:O2PlFrFGPtdUA6pY+ZmBjHUk+q+KxRXtysQT+2+CNKGYhqzMEmjkqUmcvXNBf2kv:v/r0l9ChZmBHMKxdU+vCHMZ+m6UrZ

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5792273343:AAEA9U7DCI4qHTq4iHfT5XkdD5IEsA0KtTo/

Targets

    • Target

      4.exe

    • Size

      954KB

    • MD5

      0ba9ab8a8886a1495ff3b381b891baf8

    • SHA1

      b4e05193c4697bde69b285bb102ced58ab739a93

    • SHA256

      d52464d74cb4b57f2337ac69dcac84dcb5081b3cfb7369f2a52eafe975aea12a

    • SHA512

      5712b1f2bcefe4f3828926751f98556bc376efa5bfcca22db29ce2163d8fde77119ae1500a96e47d31b8c6c21677f4172ebae6dcf369465fee0da6ea0b5fd870

    • SSDEEP

      12288:O2PlFrFGPtdUA6pY+ZmBjHUk+q+KxRXtysQT+2+CNKGYhqzMEmjkqUmcvXNBf2kv:v/r0l9ChZmBHMKxdU+vCHMZ+m6UrZ

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks