Overview

overview

10

Static

static

DATA SHEET.exe

windows7-x64

10

DATA SHEET.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DATA SHEET.exe

  • Size

    979KB

  • Sample

    221219-zbzn1aga85

  • MD5

    fca53d1616ba9ce9370929f3b386e8ba

  • SHA1

    2f022acc5807bf02007d8e19ffc6d7e06ef0787e

  • SHA256

    1d20b550fc427bfe4f3288cf3c67c81f9f32e7f6aba8a373bc730fe8fa234b77

  • SHA512

    e8c2739708e42d4f786c82a59469eb9ac71a2c4dadc813fb50985d96a2f5f04532fad57e4ca6b536865ae9594e98745059ec146dd6b92cd295329ffe4721548c

  • SSDEEP

    12288:1MKE2iNjuOx2cumQCRF43KYfDK/lKq7qsnCjc1f2FQiss/S+PmsBYiW7B5pN:uH1VuOx2cJlv5YGNKM5bNmJs6Sq

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    graceofgod@amenn

Targets

    • Target

      DATA SHEET.exe

    • Size

      979KB

    • MD5

      fca53d1616ba9ce9370929f3b386e8ba

    • SHA1

      2f022acc5807bf02007d8e19ffc6d7e06ef0787e

    • SHA256

      1d20b550fc427bfe4f3288cf3c67c81f9f32e7f6aba8a373bc730fe8fa234b77

    • SHA512

      e8c2739708e42d4f786c82a59469eb9ac71a2c4dadc813fb50985d96a2f5f04532fad57e4ca6b536865ae9594e98745059ec146dd6b92cd295329ffe4721548c

    • SSDEEP

      12288:1MKE2iNjuOx2cumQCRF43KYfDK/lKq7qsnCjc1f2FQiss/S+PmsBYiW7B5pN:uH1VuOx2cJlv5YGNKM5bNmJs6Sq

    Score
    10/10
    agentteslakeyloggerspywarestealertrojancollection

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks