Overview

overview

10

Static

static

INVOICE.exe

windows7_x64

10

INVOICE.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INVOICE.exe

  • Size

    416KB

  • Sample

    200630-qs1kvb7bjn

  • MD5

    a4975ac7f40ccf4d1803e8edb97dce9e

  • SHA1

    2c7d642447cfb2a4b1ce65659ed383b0c96f11ed

  • SHA256

    fda1d068f7b5e8dcbaa65b83088db628ebc9e6420a9fdd258fb5f62bcb4b0935

  • SHA512

    e7b9c414498f1bf101aaa8a77f94266acf6099cb62e9027a8707d71195ece5f67c48745e3f72b7f77ea15bce803990852f3668c8069b2ab4e49b527e4165a681

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ionos.es
  • Port:
    587
  • Username:
    bailen@famorga.com
  • Password:
    Famorga2017

Targets

    • Target

      INVOICE.exe

    • Size

      416KB

    • MD5

      a4975ac7f40ccf4d1803e8edb97dce9e

    • SHA1

      2c7d642447cfb2a4b1ce65659ed383b0c96f11ed

    • SHA256

      fda1d068f7b5e8dcbaa65b83088db628ebc9e6420a9fdd258fb5f62bcb4b0935

    • SHA512

      e7b9c414498f1bf101aaa8a77f94266acf6099cb62e9027a8707d71195ece5f67c48745e3f72b7f77ea15bce803990852f3668c8069b2ab4e49b527e4165a681

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks