Overview

overview

10

Static

static

3

pagamento.pdf.exe

windows7-x64

10

pagamento.pdf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2b96f1120b13dd9aacafe1f10c8dde8d698ce467b8ea0c526ff02790aaca88f

  • Size

    229KB

  • Sample

    240926-zw2zvsxfjq

  • MD5

    0d4f05904728d2b92b100f7d0c4d5651

  • SHA1

    da5fd1054dc2a631aa94d98b669115a80b81e471

  • SHA256

    f2b96f1120b13dd9aacafe1f10c8dde8d698ce467b8ea0c526ff02790aaca88f

  • SHA512

    915dee4a44ed32709a34bb0121616bdbca885e7f8d68e4df9e5887e23a803dc9f9688a8e4bc103280c7d8d9862a631edfdd3ee0807eaadc36bfe38549bd56faf

  • SSDEEP

    6144:nC0MPadRW1xCfC9iDzkmNl4Wl+jxj1WJWCcHSBqR/e:vHWHQuiDIWA10WCcHSBqY

Score
10/10
agentteslacollectiondiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.iug-trans.md/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    {h6_*$x9aAAh

  • Protocol:     ftp
  • Host:
    ftp://ftp.iug-trans.md/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    {h6_*$x9aAAh

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.iug-trans.md
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    {h6_*$x9aAAh

Targets

    • Target

      pagamento.pdf.exe

    • Size

      645KB

    • MD5

      2dc09d438a5d93330cdc95cbcc1f92df

    • SHA1

      2b347c840695d84ee8eee712f30933089efb1da2

    • SHA256

      e41ee8ef8e196d80c1db94848c6dd31eb8737b6f77d7bf63537138e110f79120

    • SHA512

      e3c755b33e72e95c161a4e90ef5e8f7e2cbe06929564c0833f3245bda9778afb0d62f02c89b5320ff154118e9dffbc1277701465b31f3d7c5305c6514674c697

    • SSDEEP

      6144:puiiukBy77yIBWK7QyfPq0bMo3pXqqIiwAvoIiCi:MdukBy77yIBWK7Qyn3pXVltq

    Score
    10/10
    agentteslacollectiondiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks