Overview

overview

10

Static

static

3

Packing list.exe

windows7-x64

10

Packing list.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    770b8fc62e3e06480cfc7a07cf431bb2_JaffaCakes118

  • Size

    417KB

  • Sample

    240727-e2b1eazgkc

  • MD5

    770b8fc62e3e06480cfc7a07cf431bb2

  • SHA1

    3f353ddeaa3f31ca826cdd1c632960af6919ad06

  • SHA256

    a56c91feaa9e55d27ee5c91a597ca4b6cfc4f22808a037ad2b4d5204da370d92

  • SHA512

    3616052a810620a04a2936361eb7849098ce4d00d4f3079bd5091a0c8a3fcb824ecb4e6cc228d496b4dffde911a21dfccce8efe9e6453abebe2c313a0e7382d6

  • SSDEEP

    12288:3GfQbEa3EVrn29Am0c3qnxeGvCQzQDYg9Jg2:2DkEBn2ebcanxeGvAX7g2

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.hyshippingcn.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    e*u@qkS4

Targets

    • Target

      Packing list.exe

    • Size

      1.0MB

    • MD5

      521726da3ce9d87caf6d4cc964b2df78

    • SHA1

      54c40889bc6e2b3269dfc19e4c4d9e33f455a0df

    • SHA256

      5b959a99608396ffb6490aa13e2c4622072e1e36426591e65b7cbe4feb6a9ff5

    • SHA512

      0775afb3e6250f64bb98f1a8473b3aa2bfbd706dbdc08baafba833ff10196d9a607c074958c676e7c0e8e4bb499173a862e6195fce7820d21d6fc6c928ab4499

    • SSDEEP

      6144:UdS7Cw80ZynTtT81z02ILyDy4310uOEo5ySum/J7EGWZd8Gp7+XJsv8994KaGGCn:g/0cozFotfLu/9DQZGCIOVsQD5g9O

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks