Overview

overview

10

Static

static

3

a990796f65...87.exe

windows7-x64

10

a990796f65...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

  • Size

    660KB

  • Sample

    240427-b1cc1ahc2x

  • MD5

    860f88b68917d3a5f57297cc22a12129

  • SHA1

    fb3315bb96fe758eb648cc31cd938e80f73afe49

  • SHA256

    a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

  • SHA512

    9d8b62094c0d594009fabe5bfba60e68b16ebf13bda69cf96136054eb17dbd527cc6f11c61e4a8e061f42b60be78d143adc243e38c8dc9f1c9e01324b7c197cf

  • SSDEEP

    12288:/UF9WMwo8A2HtW8PI4sCBOOuKT+Cv8mU/eM2TCd8xD4/oNIJlDTrS3v/4:/U2MD8dHjI4tBOOuk+oA/eL+S3Ale3vw

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.payasystem.ir
  • Port:
    587
  • Username:
    m.ghahremani@payasystem.ir
  • Password:
    ]R@u+#!J}3lX
  • Email To:
    m.ghahremani@payasystem.ir

Targets

    • Target

      a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

    • Size

      660KB

    • MD5

      860f88b68917d3a5f57297cc22a12129

    • SHA1

      fb3315bb96fe758eb648cc31cd938e80f73afe49

    • SHA256

      a990796f65eb709905c0f6499e3b3e64220c5bb9792db744d9c22bddbb603e87

    • SHA512

      9d8b62094c0d594009fabe5bfba60e68b16ebf13bda69cf96136054eb17dbd527cc6f11c61e4a8e061f42b60be78d143adc243e38c8dc9f1c9e01324b7c197cf

    • SSDEEP

      12288:/UF9WMwo8A2HtW8PI4sCBOOuKT+Cv8mU/eM2TCd8xD4/oNIJlDTrS3v/4:/U2MD8dHjI4tBOOuk+oA/eL+S3Ale3vw

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks