Overview

overview

10

Static

static

5

Receipt of...DF.exe

windows7-x64

10

Receipt of...DF.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa61a134438c66f30b00e6f93ac643c5aeeaf27fb75e0a9d0e4055f076395f73

  • Size

    754KB

  • Sample

    240727-bf7cmszcnd

  • MD5

    47583d077a426eaf2b5ada4f4b07a869

  • SHA1

    a96596817ab869533fbbfd95332efa762511eaa7

  • SHA256

    fa61a134438c66f30b00e6f93ac643c5aeeaf27fb75e0a9d0e4055f076395f73

  • SHA512

    a41f1a140f2be282e660da2b194e0fb182de511d0df1c274c63074c0378cd4bc309eb34ed581496d055dc1ec0afc394ec2f694681aefbab6e968f7c6310f5e0e

  • SSDEEP

    12288:z+ReIkKk/WkhYdiezKqNveCvwuBvUO/7P8+ioTlwTJ9eZvAFnHodEEeeUX+6:xIrssZECvwuBMO/D8+iEEJ9e8nHoSEej

Score
10/10
agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      Receipt of payment 03744 PDF.exe

    • Size

      1.2MB

    • MD5

      7a751bcda4f85feadb5073f1b21eee43

    • SHA1

      0f92303453d3ed5ee087e5b65099962182a842ee

    • SHA256

      11249774e541685aa3eed7d7fc58cc8d10491180760637c7e6d2868d909078eb

    • SHA512

      f87d3960b9b6eaf6fe9ef46ba06bfe050ff17f2a0f0188b14433199f3044d59192f1fbf8c1ce560733ed250389738a6290580f049371061183f6f2b50923a7c5

    • SSDEEP

      24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8aJw8+mgYx3eIZHM+eeew7:NTvC/MTQYxsWR7aJwbux3eIC+eHw

    Score
    10/10
    agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks