Overview

overview

10

Static

static

Payment.exe

windows7-x64

10

Payment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment.exe

  • Size

    509KB

  • Sample

    221209-rjepssgb8v

  • MD5

    6073d68b5de7fe685d6d55426d5477f9

  • SHA1

    a1dc8242f01b87a1d2f98d802b5c6108279bd743

  • SHA256

    15afda627d45b60188820d0bddba8fd8334a98dc86742eb3339834be2d4a1b96

  • SHA512

    a97a1110a08aa3ed9114d0a732e30a1d24201eb78ddf9f8858ed1a4b65041f624e2490e54d6e03a3f0cc9995194f2dda7ad49292f40ad435479690943cc7e5df

  • SSDEEP

    12288:WNGCZ+AA3y8jaY1nw4dgAVLU771IUhffM:WECmjzycg2LUX1IwM

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.svcnc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Krupashine@6791

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Payment.exe

    • Size

      509KB

    • MD5

      6073d68b5de7fe685d6d55426d5477f9

    • SHA1

      a1dc8242f01b87a1d2f98d802b5c6108279bd743

    • SHA256

      15afda627d45b60188820d0bddba8fd8334a98dc86742eb3339834be2d4a1b96

    • SHA512

      a97a1110a08aa3ed9114d0a732e30a1d24201eb78ddf9f8858ed1a4b65041f624e2490e54d6e03a3f0cc9995194f2dda7ad49292f40ad435479690943cc7e5df

    • SSDEEP

      12288:WNGCZ+AA3y8jaY1nw4dgAVLU771IUhffM:WECmjzycg2LUX1IwM

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks