Overview

overview

10

Static

static

0f54c107cf...c4.exe

windows7-x64

10

0f54c107cf...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f54c107cf3daad4695390e86d3aa2d8769003cb254ca985022182a7ba0c44c4.exe

  • Size

    731KB

  • Sample

    221208-p1slwaaa52

  • MD5

    2b429a6f4dfe55f1224864d891fa1f3b

  • SHA1

    275ff177de1de88c4a7803b01a9ea4ede8e96f8f

  • SHA256

    0f54c107cf3daad4695390e86d3aa2d8769003cb254ca985022182a7ba0c44c4

  • SHA512

    0378ae45cbf5811624e317e77b6d46fbbafafb7b49a15b3f87eb5040628ca732a343f52dcafcf6a23d9fd2f55d93f2cd02c3de15233556f4605761152fbfb45a

  • SSDEEP

    12288:/1gh/PsZ1DX/VDJjXSRBofGXhX1MinvOitpm+DOX4MHEEvQ1:/1gh/PlRBo0X1b2it0+qIMXQ1

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.chamakiotis.gr
  • Port:
    587
  • Username:
    contact@chamakiotis.gr
  • Password:
    Fyr2q?93

Targets

    • Target

      0f54c107cf3daad4695390e86d3aa2d8769003cb254ca985022182a7ba0c44c4.exe

    • Size

      731KB

    • MD5

      2b429a6f4dfe55f1224864d891fa1f3b

    • SHA1

      275ff177de1de88c4a7803b01a9ea4ede8e96f8f

    • SHA256

      0f54c107cf3daad4695390e86d3aa2d8769003cb254ca985022182a7ba0c44c4

    • SHA512

      0378ae45cbf5811624e317e77b6d46fbbafafb7b49a15b3f87eb5040628ca732a343f52dcafcf6a23d9fd2f55d93f2cd02c3de15233556f4605761152fbfb45a

    • SSDEEP

      12288:/1gh/PsZ1DX/VDJjXSRBofGXhX1MinvOitpm+DOX4MHEEvQ1:/1gh/PlRBo0X1b2it0+qIMXQ1

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks