Overview

overview

10

Static

static

3

ecdfaa43d6...18.exe

windows7-x64

10

ecdfaa43d6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecdfaa43d6e0b5ec1a715fbe9dfa8f08_JaffaCakes118

  • Size

    771KB

  • Sample

    240920-fgpanszell

  • MD5

    ecdfaa43d6e0b5ec1a715fbe9dfa8f08

  • SHA1

    5342527196894b340321d8fcc71a3a6adcf1bce9

  • SHA256

    dbb61a60d887156db921acb292375cbf9dfc334a5395f29fadc1441f31e31838

  • SHA512

    10a3808afb9094b6082b6d2de5fd6ae305b5aa1600cd16c1d38f8fc8cc206e295d01e8321d15829919f71bcf7bc0e4da75dc5585f83d64df1fcf2123f4b836d8

  • SSDEEP

    12288:Gbk3hHcd8IGtmRUl/DcFEQswdpAssgNOOv8/BArLSNI3yBjNVaLn6FH9B2n6uiw0:GSgm807cOQq80BCcHwn69DYc

Score
10/10
agenttesladiscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.tatratrading.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    FTAm_6650-

Targets

    • Target

      ecdfaa43d6e0b5ec1a715fbe9dfa8f08_JaffaCakes118

    • Size

      771KB

    • MD5

      ecdfaa43d6e0b5ec1a715fbe9dfa8f08

    • SHA1

      5342527196894b340321d8fcc71a3a6adcf1bce9

    • SHA256

      dbb61a60d887156db921acb292375cbf9dfc334a5395f29fadc1441f31e31838

    • SHA512

      10a3808afb9094b6082b6d2de5fd6ae305b5aa1600cd16c1d38f8fc8cc206e295d01e8321d15829919f71bcf7bc0e4da75dc5585f83d64df1fcf2123f4b836d8

    • SSDEEP

      12288:Gbk3hHcd8IGtmRUl/DcFEQswdpAssgNOOv8/BArLSNI3yBjNVaLn6FH9B2n6uiw0:GSgm807cOQq80BCcHwn69DYc

    Score
    10/10
    agenttesladiscoveryevasionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • AgentTesla payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks