Overview

overview

10

Static

static

SecuriteIn...33.xls

windows7-x64

10

SecuriteIn...33.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12129.3733.xlsx

  • Size

    267KB

  • Sample

    221208-p2cbaaaa57

  • MD5

    6071443d52fc119af0d876a05c83dbba

  • SHA1

    b97a01161c15e7462b13f5d65170c19984ecef0b

  • SHA256

    59c1ab21cdd58b8a8d9b4cdf0b8342a874863f16b5870e1db9dd2c1423e91aa8

  • SHA512

    132b1a493d4f6497f39d686a282aa97f355a6e4c181adf84d3d185530be961c402638d57164692c21c10ce6e415ece462ef33c1d4d33696ff84cbadae6673c91

  • SSDEEP

    6144:HZ+RwPONXoRjDhIcp0fDlavx+W26nAek0GHm4iiGIIPaT/:iHm4iVIIPW

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument

Targets

    • Target

      SecuriteInfo.com.Exploit.MathType-Obfs.Gen.12129.3733.xlsx

    • Size

      267KB

    • MD5

      6071443d52fc119af0d876a05c83dbba

    • SHA1

      b97a01161c15e7462b13f5d65170c19984ecef0b

    • SHA256

      59c1ab21cdd58b8a8d9b4cdf0b8342a874863f16b5870e1db9dd2c1423e91aa8

    • SHA512

      132b1a493d4f6497f39d686a282aa97f355a6e4c181adf84d3d185530be961c402638d57164692c21c10ce6e415ece462ef33c1d4d33696ff84cbadae6673c91

    • SSDEEP

      6144:HZ+RwPONXoRjDhIcp0fDlavx+W26nAek0GHm4iiGIIPaT/:iHm4iVIIPW

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks