Overview

overview

10

Static

static

341ff41213...bc.exe

windows7-x64

10

341ff41213...bc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8561596322.zip

  • Size

    827KB

  • Sample

    221208-wxqfnsaf86

  • MD5

    5283224035b1768ec99b6899e31b279e

  • SHA1

    210f22f680d84b459f07e4cb0feb9cc832a37ce6

  • SHA256

    4d8922b974892bd34b0d1471b80c009e2bc87482771fd033b190807c5d2ef4a5

  • SHA512

    790fc1713399d79c7bee931d40272e655332d920556c8783014493aff2525a875cb9a7f628d36ff9d94019e3f3f06db6b08c043498b23d3d137187d2a2ed2436

  • SSDEEP

    12288:5MyhPkDzT4h5XY19eEk9cVLKWR5vN/DQKu3PO+XwcmnfpWJIrz2u5kEUhPr+JWd4:5rGvTa5X/EkmWgu/CXuAJWWYk

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    host39.registrar-servers.com
  • Port:
    587
  • Username:
    enquiries@aircat-bn.cf
  • Password:
    payment 12345

Targets

    • Target

      341ff4121328104ec5db8662d94cfdfdcffd7c36bc022a8fabea180d3c19adbc

    • Size

      970KB

    • MD5

      32bbd2bd2b4d2e185783f25d64c6cdbf

    • SHA1

      32413fb565d883ce6c73ceb0bf2244dbab4303c1

    • SHA256

      341ff4121328104ec5db8662d94cfdfdcffd7c36bc022a8fabea180d3c19adbc

    • SHA512

      283168bb49700cac4132e477b4bc82f7cf2109c9e942b16efeb545e5f0e97e510bf8f54cce5d5e05b0249a82928dcc09e51c8af98afa40dbd3393cadccdb4f11

    • SSDEEP

      24576:TyeAKI2PDAEQeO6Ru9+DzOofcZ6IYrwg5+Rkz:TyepXPUH3oDzzful6e

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks