Overview

overview

10

Static

static

3

dac31e0bcb...18.exe

windows7-x64

10

dac31e0bcb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dac31e0bcbe7ee14a37e90973b3c56c8_JaffaCakes118

  • Size

    957KB

  • Sample

    240911-tz73ds1ekd

  • MD5

    dac31e0bcbe7ee14a37e90973b3c56c8

  • SHA1

    d42122dc4d28ea3991a69f8110429486cc6e3d7b

  • SHA256

    d27811d8d6973b0a3996311ab81217502d9aedc4e9b3fe34c701fb37eadbb8c8

  • SHA512

    dc357a6ffe997daed0be5065a1aab49ea7be0b6c482f9c7d854a539928ccbd1fe14324b63dd6e28dc4211df71e7bdf806a92b2b7d5762487743f56e28eb63e8c

  • SSDEEP

    24576:HlOcanTxmu0u5lfXg4rjIGySXAgGPaOu0rS3kP0:HGtm2fXhIbUAru8SkP0

Score
10/10
agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.smart-noodles.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    info@#$%^&*()

Targets

    • Target

      dac31e0bcbe7ee14a37e90973b3c56c8_JaffaCakes118

    • Size

      957KB

    • MD5

      dac31e0bcbe7ee14a37e90973b3c56c8

    • SHA1

      d42122dc4d28ea3991a69f8110429486cc6e3d7b

    • SHA256

      d27811d8d6973b0a3996311ab81217502d9aedc4e9b3fe34c701fb37eadbb8c8

    • SHA512

      dc357a6ffe997daed0be5065a1aab49ea7be0b6c482f9c7d854a539928ccbd1fe14324b63dd6e28dc4211df71e7bdf806a92b2b7d5762487743f56e28eb63e8c

    • SSDEEP

      24576:HlOcanTxmu0u5lfXg4rjIGySXAgGPaOu0rS3kP0:HGtm2fXhIbUAru8SkP0

    Score
    10/10
    agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks