Overview

overview

10

Static

static

Payment & ...ce.exe

windows7_x64

10

Payment & ...ce.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment & Revised Proforma Invoice.exe

  • Size

    402KB

  • Sample

    200630-wjlk4mspsx

  • MD5

    0b41d4a0669721c9ce59863deb1e5811

  • SHA1

    404a42f7a91bebceb0e42d7b80162e38d679bd4d

  • SHA256

    5ec9293c84bbb32bbdd575f86f9b9e161c6869df311f02096c280db1985c2c59

  • SHA512

    b3fafde81bcaea9e2804f2d97e356d3f2058b3b534ba0568082fb142661c65027fd159cdfab0ac01603cd312fb8f8f63a574f68dd77c8d9cba5bd2e4b7a15293

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    login112004@yandex.com
  • Password:
    Ikechukwu12

Targets

    • Target

      Payment & Revised Proforma Invoice.exe

    • Size

      402KB

    • MD5

      0b41d4a0669721c9ce59863deb1e5811

    • SHA1

      404a42f7a91bebceb0e42d7b80162e38d679bd4d

    • SHA256

      5ec9293c84bbb32bbdd575f86f9b9e161c6869df311f02096c280db1985c2c59

    • SHA512

      b3fafde81bcaea9e2804f2d97e356d3f2058b3b534ba0568082fb142661c65027fd159cdfab0ac01603cd312fb8f8f63a574f68dd77c8d9cba5bd2e4b7a15293

    Score
    10/10
    spywarekeyloggertrojanstealeragenttesla

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks