Overview

overview

10

Static

static

3

Tender RFQ.exe

windows7-x64

10

Tender RFQ.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e353803a7a2b04eb7cb26f475050de1702f56ce2fee2386d09790bc6d33108ad

  • Size

    1.5MB

  • Sample

    240328-ccwbmscg7x

  • MD5

    063b99ed9266ad0a9e72d1ae3a5a0d7d

  • SHA1

    cdb7262b70bdf74c5965d31f9a74ffe988f4c038

  • SHA256

    e353803a7a2b04eb7cb26f475050de1702f56ce2fee2386d09790bc6d33108ad

  • SHA512

    7e9c1471c741b42bc138c7be8c47d4a666a720d3b8e657e58a3bdd19efeaaf990ad285590f44088965b66662eedaa2545eec9fa4afd857430b41d79be5b7e24b

  • SSDEEP

    12288:dbPngUuDdw6O3nlozYHNpJ6LHszuFYv6XFgTbfELyQgHIefWAs:dbPRuRw68nlPtr6l1GfEbK3+L

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6834342758:AAHnpbyPCzi-sEo22oVL6DdX9cuTElu_WyA/

Targets

    • Target

      Tender RFQ.exe

    • Size

      810.6MB

    • MD5

      e4a6bda9ed47c81b819f8addd8206bcd

    • SHA1

      f1f8281a34be44f66d26bbbe30a70f1929a04813

    • SHA256

      49cca3ae4113512cf93f611f37ab2a9bf7dc8ce6202083f9ba7d45dbde634682

    • SHA512

      0497e79e43aeee8de89e1f0c6d533227aaed27088cfae4a7a40dee87057ff8e163f044d63f48e583736e165e5e04d3f602aa5129fd30b2b5bfd625450f11967c

    • SSDEEP

      12288:sbPngQuFdk6Wjn1ozqZN9N6jHszKpIFzdgLbjE/yo3L0r+4Byna5W:sbPluTk6Gn1n336OZMjESr1Yt

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks