Overview

overview

10

Static

static

Solicitud ... n.exe

windows7_x64

10

Solicitud ... n.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Solicitud de cotizacioÌ n.exe

  • Size

    429KB

  • Sample

    200629-34wgt973fx

  • MD5

    88d4f79ba178767c268c272a18f43b4e

  • SHA1

    3f2570f1a8f34c89b1f1367b41a7971ab6720833

  • SHA256

    0182db6c14d559c187954e88fbae9157b1b90c8edd6720c74cad8523f7117809

  • SHA512

    7f8fed5e3a44f79227bbf148edd51eb557d21b50d3bdf580881fe1bcd83505233521387e89ad58e01adb021c20fb13577c5ed7089880e385b2c89b769305e4ee

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.pharco--corp.com
  • Port:
    587
  • Username:
    mohamed.elshimy@pharco--corp.com
  • Password:
    tHKfMRa2

Targets

    • Target

      Solicitud de cotizacioÌ n.exe

    • Size

      429KB

    • MD5

      88d4f79ba178767c268c272a18f43b4e

    • SHA1

      3f2570f1a8f34c89b1f1367b41a7971ab6720833

    • SHA256

      0182db6c14d559c187954e88fbae9157b1b90c8edd6720c74cad8523f7117809

    • SHA512

      7f8fed5e3a44f79227bbf148edd51eb557d21b50d3bdf580881fe1bcd83505233521387e89ad58e01adb021c20fb13577c5ed7089880e385b2c89b769305e4ee

    Score
    10/10
    spywarekeyloggertrojanstealeragenttesla

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks