Overview

overview

10

Static

static

10

d8c769a0a5...40.exe

windows7-x64

10

d8c769a0a5...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8c769a0a595f87e324e4e36021306b6bbf6005b498832730d6e5931d357a440

  • Size

    234KB

  • Sample

    240327-crjw6aac98

  • MD5

    00eb40f4ac2592f1a1ff8cb465f390d6

  • SHA1

    3a7f575cccd1fa5f5512f290e533208a18e0537d

  • SHA256

    d8c769a0a595f87e324e4e36021306b6bbf6005b498832730d6e5931d357a440

  • SHA512

    770e102c00b99613c1f65099674ab534f1866baa42dad80ae296464fac75c3e2fd4cdf6e2898b88bd755485b6b9b357a9b884a75333de3d463ef0d4e911a4c8e

  • SSDEEP

    3072:gJAuR1ZlxXh4XVhxbc+v2v8iYkb5G3/sS3J+V:gJJR1ZlxCXVhxbc+hiYkEsgJ

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ionos.es
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Valer0_Factory

Targets

    • Target

      d8c769a0a595f87e324e4e36021306b6bbf6005b498832730d6e5931d357a440

    • Size

      234KB

    • MD5

      00eb40f4ac2592f1a1ff8cb465f390d6

    • SHA1

      3a7f575cccd1fa5f5512f290e533208a18e0537d

    • SHA256

      d8c769a0a595f87e324e4e36021306b6bbf6005b498832730d6e5931d357a440

    • SHA512

      770e102c00b99613c1f65099674ab534f1866baa42dad80ae296464fac75c3e2fd4cdf6e2898b88bd755485b6b9b357a9b884a75333de3d463ef0d4e911a4c8e

    • SSDEEP

      3072:gJAuR1ZlxXh4XVhxbc+v2v8iYkb5G3/sS3J+V:gJJR1ZlxCXVhxbc+hiYkEsgJ

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks