Overview

overview

10

Static

static

10

Request fo...97.exe

windows7-x64

10

Request fo...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e31fe90aae5b910dfff40ede572d1273_JaffaCakes118

  • Size

    291KB

  • Sample

    240915-w4hpeawgqg

  • MD5

    e31fe90aae5b910dfff40ede572d1273

  • SHA1

    caccc20a25fe5b9f510110b814493ae63b0a296a

  • SHA256

    b45055a1888512ef8398263c0b74086b759048e9ab186a36c765583bfc1e952b

  • SHA512

    8c2ec99b36ed592765d796f7174c142eaa31d75b3ad9fd0efe166d09432b2ef2f4e79bb4c0dcdccffb253ce1fa3079c27f96996421957246802582adbf7b1c7b

  • SSDEEP

    6144:VMk5sYCR8rC8/5u3AgNYzbbGQ4ZPW2EwrPZAQo3amBAC3W9kMWHuT:lttrCIoNq3T4Y2EEeQoKmpMWOT

Score
10/10
agentteslaagilenetcollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Request for Quote - 6000412697.exe

    • Size

      680KB

    • MD5

      dd20d2512dd9dbfc2dbed9563c6ea1d4

    • SHA1

      7f6a2ee121e006a7bf049c1e63b51c0978e46947

    • SHA256

      732bae130c34155713bda6f16636b2063e5e8e35864d0352b2f3f343fab645cb

    • SHA512

      35bab27fb74ae1f1e5b996b4e0eb0986d7a626511c23ab394532d2a9d56d2472e7a2dbc9abcc965fc1f0e34d56992cc6c0cb303f3f9072ad4286eb2d7e20be0f

    • SSDEEP

      6144:ENg5JHngPhIJeFA2eFAkhIk6mbYiAr5gmQ8b3LNMK5vfAqRXjb0roFBVLnWFby3s:EQJg0z2z0YiQRQ8qUnjcoFBVLWF2/

    Score
    10/10
    agentteslaagilenetcollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks