Overview

overview

10

Static

static

3

Invoice.exe

windows7-x64

10

Invoice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2292339c7c0a5fbcc46b84c676d901151c1b7fc371fa2c3f4904e538fd2d0092

  • Size

    672KB

  • Sample

    250121-fg3s3axmbn

  • MD5

    5d061f5b1682f7fd084ae54647c08b6f

  • SHA1

    cc20010b2da926911d5a36ce3b6cbf850609dbbd

  • SHA256

    2292339c7c0a5fbcc46b84c676d901151c1b7fc371fa2c3f4904e538fd2d0092

  • SHA512

    80fd0d193ec992b2a4cfa5a61d073d223c343df3143acc86564eb39f1bc587ce27f655d98675fe18266dd59665f59eaa8d4f440c2e37244b60382cd44661af27

  • SSDEEP

    12288:IzztYbSCyFWF0Mye9JWwdy2DDkZP3vrH9U2LtkfERi6B0D4VDFo9sydDrF:opYUMH5y2nktjdEfERiY0DOBtypF

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.thelamalab.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Thel@malab@20!9

Targets

    • Target

      Invoice.exe

    • Size

      778KB

    • MD5

      4b87b32f26b417ddbaaa08391cbf3dfd

    • SHA1

      f870a7b9eec7352c7863f2491cabdb404cf53a0d

    • SHA256

      3729df5275a3dbba2ea3c90fac7796341a6d2c397ceb0bb5fc98b99a7f76df1d

    • SHA512

      5a7e97e4bba2a2cc4b3a3a4a623aa3cb5a252a776a4c9f796b5272d3c1d735bab8fbca2163421d7d3bf1bbe0d37b2a1f864227f2cb545323f9c1fd2339f1a0a7

    • SSDEEP

      12288:2KOlbxrEX0IO8Df3PScPgY93W2dyQ1DkJT39bH9usL9wJExi+ByD4RF3mrU:PX/f1PRxyQhkdlduJExi0yDgF3mA

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks