Overview

overview

10

Static

static

10

0864575d4f...a0.dll

windows7-x64

3

0864575d4f...a0.dll

windows10-2004-x64

3

933511776c...82.dll

windows7-x64

10

933511776c...82.dll

windows10-2004-x64

10

62bc8624b6...18.exe

windows7-x64

10

62bc8624b6...18.exe

windows10-2004-x64

10

bea9fc6693...3a.exe

windows7-x64

10

bea9fc6693...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    samples.zip

  • Size

    7.0MB

  • Sample

    250220-lgp5vstlz8

  • MD5

    5d38df343650fc8ffb48fd7b2d9ab480

  • SHA1

    6dc3380f3952d06e446a10819a17196366221f1c

  • SHA256

    975ec4a6250960b45606ce9c155560c3283a3df4ffab69ec81f8cabdbc714b0e

  • SHA512

    202f2e6920d09c946408ac19922797a8cebda81417d82b5085a2d5be17b857d215d8ab29bbee4619c18657242f75059796cc4f59c07f07fd145ea722867a8acf

  • SSDEEP

    196608:MSm1UwXO5KKD++70lt0qpFalPd1ULrE+B8hBEAYJJn6UOmp:y1U5KKD+jjRpFMArE+ByErJJn6UO6

Score
10/10
agentteslaemotetepoch4bankercollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080
eck1.plain
ecs1.plain

Targets

    • Target

      0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0.dll

    • Size

      225KB

    • MD5

      72ba727d7441954ecaefd9732d12a36c

    • SHA1

      ab291a932bcc1c74231a7a7fda74017956927f37

    • SHA256

      0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0

    • SHA512

      8080baf789cfcf2edd481e581c4cd174340b36a159707c21506693085f70b60c82207af9e778468106734ebeba83f647b49805712eefbb50056ad6860aa36ac8

    • SSDEEP

      3072:gjm1AMcU4GexYvBitvoAjwD0ggLSnWz/E75oNzbmC9LLxvNDrHj2YuG2TaB:R18UNe66vo1D0cEe5QiC9XxvNDLTu

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      933511776c5c34172b315807d11ecdd0c802f94492cace5c7127d1ddf47b2c82

    • Size

      735KB

    • MD5

      14e8fc68273e3cc5377ea8efd0230273

    • SHA1

      49069bf64828b11730c36f112fde9131c3c86a63

    • SHA256

      933511776c5c34172b315807d11ecdd0c802f94492cace5c7127d1ddf47b2c82

    • SHA512

      6cbf4d197b8fabfccbfb516acd4c11cb23934c3606e8ade1cfcf3845e2748405fb3b2d2012ad052607e4e959aea2bc75365ee9d8ca2bba7d1f4e1074ca35568a

    • SSDEEP

      12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkpodzR6TqKCKDeS:tviEdX3Y7GTCRhukkpbqUx

    Score
    10/10
    emotetepoch4bankerdiscoverytrojan
    behavioral3behavioral4

    • Target

      62bc8624b6ed645ddbe1420ca67376863c88e58e347fc8282001a2b9e3330918

    • Size

      574KB

    • MD5

      00fe3f2a77b6bb57385d403411d45e39

    • SHA1

      ad101cb7eab390ed45ec84294da65059aa2fde70

    • SHA256

      62bc8624b6ed645ddbe1420ca67376863c88e58e347fc8282001a2b9e3330918

    • SHA512

      b7fedd8e92b2569130df1faa8cfd5736d457c98991d0a14ce059e05b37bea79e36cd970d06510b4397c08333737d166c8e7121c037713e35fd5fabe53290aa13

    • SSDEEP

      12288:YmEUG3Ap0FzZL2gSOfVxTaSaSehhjtrS2KlP:Yrp3E0FzZDSm3W+IU

    Score
    10/10
    agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • AgentTesla payload

    • Drops file in Drivers directory

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

    • Target

      bea9fc669319cd16df759974397e79c05e7565e75ca7c052af346e08b5f1d13a.exe

    • Size

      216KB

    • MD5

      f491169c61e8aa6cfa83e00c3f7e85e2

    • SHA1

      91b843f4747ae0a97f83b6cba7f329f6a1503928

    • SHA256

      bea9fc669319cd16df759974397e79c05e7565e75ca7c052af346e08b5f1d13a

    • SHA512

      e0c2a061404f9d0333c62366e6974445eb6349f6a900b5c7fe40fa9c6f74c94637f2ca0bc9fc03dfed7b654312dfc89b5f92602caf9699f0b22ed28ae9f0ea8d

    • SSDEEP

      3072:7GWebH9OGNKb/ApyjbFSHZUsSeiMeK++koKcqIQKUsWlB32wufpxSkVPs6v9cwxe:7ejpyjA5UbMX+n7O/Wld23dzopTk

    Score
    10/10
    agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • AgentTesla payload

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks