Overview

overview

10

Static

static

3

Revised Pr...PF.exe

windows7-x64

10

Revised Pr...PF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Revised Proforma Invoice WSI116850PF.r00

  • Size

    462KB

  • Sample

    230609-xs3qwadh51

  • MD5

    4ad19f3b83382bd4874693be46fae7c3

  • SHA1

    fd4db67eebeab60048a85e2cf9c10510d815af58

  • SHA256

    42c9d1c730159fea42ed1ae38835ffc8427baf94e5e5fa59e9b140b505cd273c

  • SHA512

    204326728773f38b7ef8b2bb0ed2376b0c15a697db4686fa56ebea77d3fefb5bf6406e59f7b8f6f1f8d862fe8c3b36a417977fd620c64523c075eb5627fc8e96

  • SSDEEP

    12288:wwc3aeUzJhOFbM4W1lBzoEfPWMquVdnAyL4bry:IKemfOFbDWfC6KCtke

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.sorincrop.com
  • Port:
    587
  • Username:
    rck9897@sorincrop.com
  • Password:
    blessing202321@!$%btr
  • Email To:
    vinod@sorincrop.com

Targets

    • Target

      Revised Proforma Invoice WSI116850PF.exe

    • Size

      884KB

    • MD5

      eac45e7940e2536662d67f5c2bb888f8

    • SHA1

      99accc50514d38dfd74883b10789a471f4cc2bca

    • SHA256

      3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a

    • SHA512

      9053620605e242827e03dc5632e55dfef2ad839a63f5ad2be0d6e0a0a750e46c20e6d944623518e68753838f1629fe72ef5a48f780d12fbc33afef348ce16fc3

    • SSDEEP

      12288:EW0lwFqIwr+i3Tp3OQwN5V2cKxZMXdKkDkB0c:RZFwTp3duL2xxGKoy0c

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks