Overview

overview

10

Static

static

Payment Advise.exe

windows7-x64

10

Payment Advise.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    A1A65C2B75D242D817C7766BAB1D947E2841D22870258D23FB5A69EB04FBEBB4

  • Size

    574KB

  • Sample

    221208-yfd3esbb95

  • MD5

    c90e17aa03c46eca69a087c5156878bc

  • SHA1

    1f136f4fbe8a5ff5fecd6721f727350e9ca70478

  • SHA256

    a1a65c2b75d242d817c7766bab1d947e2841d22870258d23fb5a69eb04fbebb4

  • SHA512

    0e8743176eecba98ea3e2276b14d15dcafbbbde6cc2468d3580bef2321dbea26caf21be1bde53e44806feee90d8344fe9ba8bd4a367e7103321d3744db5ad681

  • SSDEEP

    12288:A62s7jC+YpmgoXhBeG6bjjD/z9csVWFRXld/xng9QYB:AorLhBf6jjDVWxldZng9QM

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    chinedu2@

Targets

    • Target

      Payment Advise.exe

    • Size

      786KB

    • MD5

      ddb15a4c31bd7e0e7cf3d7cac8232f5f

    • SHA1

      761590b2db740edbe30bf3232998c258062b169a

    • SHA256

      fde52c018e73c2ac8a5f52796e06d7f35f9cfb197665d0ddb3dc6729c93cccb8

    • SHA512

      d2d5110df0ee93aa294237abaea8e654dc9d620d6e6540366de87888dcba91b1db532c9c2417c42f6d137744cc7a1418167e9997f4a4c03e94c590d3d79a999c

    • SSDEEP

      12288:IVmNAcv9ul/Z63ovN9LOfMe/xoKCT6Gx9QzjSCGmZJbxpDF+B7hC8Jf1:smNzV4KoT2c62CG

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks