Overview

overview

10

Static

static

3

e178ae1de0...03.exe

windows7-x64

10

e178ae1de0...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e178ae1de056b3463f929009b08b3c03

  • Size

    490KB

  • Sample

    240327-mrr8msac98

  • MD5

    e178ae1de056b3463f929009b08b3c03

  • SHA1

    e1e363f5e0cee78e1a2d2ad606be7529c58203c2

  • SHA256

    e7c30df0932d6ccaffe8eb817c2ed422920fb958b04d38f3f8c53f3a9953f214

  • SHA512

    6bdb2875bb60447daea8760ef76977545e2c9a6a8163a4bbecf57009aed0784ee9795ff9111f06beb6e6e99aea2764a7db8637e426a2a2338c7bb4b89b9e40b7

  • SSDEEP

    6144:BJCUD1099JzbK9ju7xtH9lSirp+wjUzkx7EZBJ+Z/q3fM/Vd9A1MbEWNN15naFv4:V49H3LMwjU8qBJKi3GTS13wN8v6eC

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.fakly-cambodia.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Mmhh#2014

Targets

    • Target

      e178ae1de056b3463f929009b08b3c03

    • Size

      490KB

    • MD5

      e178ae1de056b3463f929009b08b3c03

    • SHA1

      e1e363f5e0cee78e1a2d2ad606be7529c58203c2

    • SHA256

      e7c30df0932d6ccaffe8eb817c2ed422920fb958b04d38f3f8c53f3a9953f214

    • SHA512

      6bdb2875bb60447daea8760ef76977545e2c9a6a8163a4bbecf57009aed0784ee9795ff9111f06beb6e6e99aea2764a7db8637e426a2a2338c7bb4b89b9e40b7

    • SSDEEP

      6144:BJCUD1099JzbK9ju7xtH9lSirp+wjUzkx7EZBJ+Z/q3fM/Vd9A1MbEWNN15naFv4:V49H3LMwjU8qBJKi3GTS13wN8v6eC

    Score
    10/10
    agentteslaevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks