Overview

overview

10

Static

static

3

e01f1380ae...c5.exe

windows7-x64

10

e01f1380ae...c5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e01f1380aeb3502ac454470540ad53c5

  • Size

    1.3MB

  • Sample

    240326-z6j7ssfe7z

  • MD5

    e01f1380aeb3502ac454470540ad53c5

  • SHA1

    6da056bd6c1c4b0f34f5d7ceff58398729eb9129

  • SHA256

    bbd2977d69441d934917ec16e2adf08db3a5ba8a55d2800edff5715dbcb80a23

  • SHA512

    dbc5ac80248b4cc81390bd9b07150156373925b608657c4db907658ad7190a80e629903ecb7f0949e557ac28321f84bd88421643b96d2a62fc3cfb5953cd4267

  • SSDEEP

    24576:VCvxKFksKksqv7JvZI14dCp9fLSUNBOvx5y8jP8N6ZxHaE75/dZZ:VCvxKXJvZIJfLl7YEN6Zxb

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    67968664JeBlachqwin

Targets

    • Target

      e01f1380aeb3502ac454470540ad53c5

    • Size

      1.3MB

    • MD5

      e01f1380aeb3502ac454470540ad53c5

    • SHA1

      6da056bd6c1c4b0f34f5d7ceff58398729eb9129

    • SHA256

      bbd2977d69441d934917ec16e2adf08db3a5ba8a55d2800edff5715dbcb80a23

    • SHA512

      dbc5ac80248b4cc81390bd9b07150156373925b608657c4db907658ad7190a80e629903ecb7f0949e557ac28321f84bd88421643b96d2a62fc3cfb5953cd4267

    • SSDEEP

      24576:VCvxKFksKksqv7JvZI14dCp9fLSUNBOvx5y8jP8N6ZxHaE75/dZZ:VCvxKXJvZIJfLl7YEN6Zxb

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks