Overview

overview

10

Static

static

1

Overdue Account.exe

windows7-x64

10

Overdue Account.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Overdue Account.exe

  • Size

    672KB

  • Sample

    240429-ler7fafb74

  • MD5

    8858954bbf2c3f1525ca1f6d07788ba3

  • SHA1

    5b7d021ebb6e64abbdc51a5c0469f6287f1924f1

  • SHA256

    57cfb4702d6902a5848f4c9536381f46e1b1b4870f5df749ba4d3f15660e8947

  • SHA512

    7e542f25518fa023c844b3924c73ab5e65ff15ddc8731a8af5b34ce30aa53f87fdee78b7c53a8e968240d73c5cadcb76a05a5374dea072c6e259e989dbc7c70d

  • SSDEEP

    12288:kRkB778QH82WS8U9AadmiotMCi3uQiXD0gNVT8d0W4Ubk0ILqRKs8i3W6BvxBkR:KkBR82vZ9An9pZQg0qZW00MqRKiG69+

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Overdue Account.exe

    • Size

      672KB

    • MD5

      8858954bbf2c3f1525ca1f6d07788ba3

    • SHA1

      5b7d021ebb6e64abbdc51a5c0469f6287f1924f1

    • SHA256

      57cfb4702d6902a5848f4c9536381f46e1b1b4870f5df749ba4d3f15660e8947

    • SHA512

      7e542f25518fa023c844b3924c73ab5e65ff15ddc8731a8af5b34ce30aa53f87fdee78b7c53a8e968240d73c5cadcb76a05a5374dea072c6e259e989dbc7c70d

    • SSDEEP

      12288:kRkB778QH82WS8U9AadmiotMCi3uQiXD0gNVT8d0W4Ubk0ILqRKs8i3W6BvxBkR:KkBR82vZ9An9pZQg0qZW00MqRKiG69+

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks