Overview

overview

10

Static

static

1

Payment Ad...DF.scr

windows10-2004-x64

10

Resubmissions

27-03-2023 17:36

230327-v6qmcsge8w 10

27-03-2023 17:12

230327-vq696sed96 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment Advice.uue

  • Size

    1.0MB

  • Sample

    230327-v6qmcsge8w

  • MD5

    1c5f2525ad6f9d75a37fe2f19ae86874

  • SHA1

    4ec6cfb30ba46d5f25a20882e34a79d93308e0c6

  • SHA256

    29efdf272b04b30f02ea92893e88ce3d41a3c30f887e564cbc3a62b9d31d2904

  • SHA512

    517605079d1f02afbd631b052c7a92702b8ad1a80855373e00d63535bd6cdc609c93d948ddfc10bd21883b11ca97da419099a9c5efb55a91c7bc73eefda68a6f

  • SSDEEP

    24576:dgi/pGRkPZnm0xHvnHRhIpNdqqaYgE2u6KWkwc98:d/C2nm8Hvz+NQqaYJBXH98

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    baitunniniola@yandex.com
  • Password:
    skckiglxqgwrfpxh
  • Email To:
    baitunniniola@yandex.com

Targets

    • Target

      Payment Advice_PDF.scr

    • Size

      2.4MB

    • MD5

      5d5a06166ce1d99636634c4016618c01

    • SHA1

      8102c713286ace56d07914cc6164e27412d2d17d

    • SHA256

      09da622ef3e5d5a12d5b51075e06a1ed054ac21d37eadb07cd901366150895a7

    • SHA512

      3732f1d8fe6ad4b25639799c21f9d590ebbfbae7d648db99d1e3f21f752a7e0f3db11c0217d29ffb745ed814100f435bed879a9db8b2a1ebf2a12213b4575ec9

    • SSDEEP

      49152:6T2UxXSau0WZL41of2iBUQQ/xD6WWdru:ff2bQQ/xD6W

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks