Overview

overview

10

Static

static

3

Shipping.exe

windows7-x64

10

Shipping.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02e7c008d926765d64488ab4b95bc97b01cdd2cc13b0b2479931092a261ca72f

  • Size

    696KB

  • Sample

    250121-bd5e9sykds

  • MD5

    3225648ae91a7a635b8e114fed016583

  • SHA1

    dd70219c6648d83035488c833e34618882f9e1fc

  • SHA256

    02e7c008d926765d64488ab4b95bc97b01cdd2cc13b0b2479931092a261ca72f

  • SHA512

    9699eabaf24d5d36b9368c3cc43319eb1c081f55256f35a672016a2023db1805dfd193ab62bc2cb1992b8a58446eab9ec5a8764abb21d4cd055c78c89cad5062

  • SSDEEP

    12288:bRKy+jIVKEFS4nbdX5An5yhiZ2vkCaYiQhBiDVr1QSKxPCXHq43QSD7YnhqBv:bRKyNZA4xpqyA2TbY5reTlUr3lYhO

Score
10/10
agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Shipping.exe

    • Size

      733KB

    • MD5

      eedbda81d4f3d69ee2798e40a8a5572b

    • SHA1

      68226fb98f6e93db77d607dcc305716e8a80871d

    • SHA256

      42c52ed2af4708289cb182a0fd83026691eabc7c4916a3ef0cf8a01b5f890856

    • SHA512

      e83bdf38d169461846fd63f34b5458f3198adbe796f8be9d7947219a4e9b67cb51e97a39065a1ba49131f9a310de7332eab0d5a215053ffde535d30eddcdebb0

    • SSDEEP

      12288:O7G3eV0l1vF6gv+W5DzalTl3YeirTX/8pi+eAH5vgQVT/fRO8UYeA6h:2V0eM1DzalFYvPX/yi+pZvgiLf4Fa6h

    Score
    10/10
    agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks