Overview

overview

10

Static

static

1

c730d9043c...09.exe

windows7-x64

7

c730d9043c...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c730d9043cb5bd6d4152a91ceb0efa5af74d00510f73ef536467f2ee7f133809.exe

  • Size

    1.7MB

  • Sample

    230206-rrve8aec79

  • MD5

    f0b6cd86a2a88851836dc68b9d6e5995

  • SHA1

    14e3b625bf2572fe6c7923392774adafbbb365bb

  • SHA256

    c730d9043cb5bd6d4152a91ceb0efa5af74d00510f73ef536467f2ee7f133809

  • SHA512

    c10a2ec7b34f575513afbf3355fd534027879fde0ab5cc2ec32c80bc0164e328044ab12249f94b7594cab6d3099578bdc1209be6f0052b1540e4e774b48fad2a

  • SSDEEP

    24576:/svHDgmT4k5ivRI/4RelcQ/dqFR/X5YTuXzkyLP0L+YFjX1twx+ILNl5YGZx:/2Dp4umRI/Vl3VwYqXIMO+SQocNx

Score
10/10
agentteslarhadamanthyscollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.clipjoint.co.nz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    melandloz64

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      c730d9043cb5bd6d4152a91ceb0efa5af74d00510f73ef536467f2ee7f133809.exe

    • Size

      1.7MB

    • MD5

      f0b6cd86a2a88851836dc68b9d6e5995

    • SHA1

      14e3b625bf2572fe6c7923392774adafbbb365bb

    • SHA256

      c730d9043cb5bd6d4152a91ceb0efa5af74d00510f73ef536467f2ee7f133809

    • SHA512

      c10a2ec7b34f575513afbf3355fd534027879fde0ab5cc2ec32c80bc0164e328044ab12249f94b7594cab6d3099578bdc1209be6f0052b1540e4e774b48fad2a

    • SSDEEP

      24576:/svHDgmT4k5ivRI/4RelcQ/dqFR/X5YTuXzkyLP0L+YFjX1twx+ILNl5YGZx:/2Dp4umRI/Vl3VwYqXIMO+SQocNx

    Score
    10/10
    agentteslarhadamanthyscollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks