Overview

overview

10

Static

static

1

SOA.exe

windows7-x64

10

SOA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SOA.exe

  • Size

    773KB

  • Sample

    230206-trclhseg75

  • MD5

    3ebc264726e016753005e6e66aa27c99

  • SHA1

    d88902ab95a265cbe2c5820728d76a308ed074b5

  • SHA256

    82fa2e380616334eee0b0c78688cc1101dc693d2d8a241ab0c2abc731d9a2210

  • SHA512

    adc09b0c7648ef397c02b9669c4064772090cdfe0d598185569091baa58d9586f3b494abca09728e35345d540cf44b3abf079b5baea927bfdb9b40cb43196617

  • SSDEEP

    12288:PLJPAfjgWW6ks8x7Rb8OP+wmk7uhLITsLDY49kTX6LcXnyXx6q16ahRZ5Gcg:RAUeZ8tQJd9k76L1NMS5GZ

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.abaexlogistics.com
  • Port:
    587
  • Username:
    operations@abaexlogistics.com
  • Password:
    Op3r@2021!
  • Email To:
    ericsales878@gmail.com

Targets

    • Target

      SOA.exe

    • Size

      773KB

    • MD5

      3ebc264726e016753005e6e66aa27c99

    • SHA1

      d88902ab95a265cbe2c5820728d76a308ed074b5

    • SHA256

      82fa2e380616334eee0b0c78688cc1101dc693d2d8a241ab0c2abc731d9a2210

    • SHA512

      adc09b0c7648ef397c02b9669c4064772090cdfe0d598185569091baa58d9586f3b494abca09728e35345d540cf44b3abf079b5baea927bfdb9b40cb43196617

    • SSDEEP

      12288:PLJPAfjgWW6ks8x7Rb8OP+wmk7uhLITsLDY49kTX6LcXnyXx6q16ahRZ5Gcg:RAUeZ8tQJd9k76L1NMS5GZ

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks