Overview

overview

10

Static

static

3

Faktura El... .iso

windows7-x64

3

Faktura El... .iso

windows10-2004-x64

3

out.iso

windows7-x64

1

out.iso

windows10-2004-x64

1

Faktura El... .scr

windows7-x64

10

Faktura El... .scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Faktura Elexa_FV24103_pdf .img

  • Size

    92KB

  • Sample

    240701-n1frmszejh

  • MD5

    03231e3ab082825c61ef1e7e097752dd

  • SHA1

    566e4d9f0b2588b9a310213aa496179339f1d758

  • SHA256

    eb56586394b02b762dd8e55ff044e31142f46b3d3efd143dac818a61784bc693

  • SHA512

    27971e092e55448052f990a73d6041663452ed4720c960b9f7a0f4c502aef4390e0f7426a223af33b9fa279a8d33ce625d43c4cf2a9f46a6f67c375e23faf6a8

  • SSDEEP

    768:ZJ4UgWq/hHcO4x+BQC0WX57XDyaBNHVxYoAUQ/lX:r4fB8KBQC0kBTygVxLLqV

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.mediatrend.it
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    PugsmgkHD4

Targets

    • Target

      Faktura Elexa_FV24103_pdf .img

    • Size

      92KB

    • MD5

      03231e3ab082825c61ef1e7e097752dd

    • SHA1

      566e4d9f0b2588b9a310213aa496179339f1d758

    • SHA256

      eb56586394b02b762dd8e55ff044e31142f46b3d3efd143dac818a61784bc693

    • SHA512

      27971e092e55448052f990a73d6041663452ed4720c960b9f7a0f4c502aef4390e0f7426a223af33b9fa279a8d33ce625d43c4cf2a9f46a6f67c375e23faf6a8

    • SSDEEP

      768:ZJ4UgWq/hHcO4x+BQC0WX57XDyaBNHVxYoAUQ/lX:r4fB8KBQC0kBTygVxLLqV

    Score
    3/10
    behavioral1behavioral2

    • Target

      out.iso

    • Size

      92KB

    • MD5

      03231e3ab082825c61ef1e7e097752dd

    • SHA1

      566e4d9f0b2588b9a310213aa496179339f1d758

    • SHA256

      eb56586394b02b762dd8e55ff044e31142f46b3d3efd143dac818a61784bc693

    • SHA512

      27971e092e55448052f990a73d6041663452ed4720c960b9f7a0f4c502aef4390e0f7426a223af33b9fa279a8d33ce625d43c4cf2a9f46a6f67c375e23faf6a8

    • SSDEEP

      768:ZJ4UgWq/hHcO4x+BQC0WX57XDyaBNHVxYoAUQ/lX:r4fB8KBQC0kBTygVxLLqV

    Score
    1/10
    behavioral3behavioral4

    • Target

      Faktura Elexa_FV24103_pdf .scr

    • Size

      31KB

    • MD5

      98da04a6b0b83989d1bee2eda1ca6c50

    • SHA1

      26a122571f8f81a40ce78b06d7c9d89b19923fac

    • SHA256

      ffca66beb014d70ebd6242618f97426da7466ea3e3fcf033b7ec39e9c94d2bf8

    • SHA512

      115237af29b47f5dbaa01db08e18a271717104e177c52c434e938e93cf4d58f8090e5fe5182228f3144adf55144f3b846d0c4fa245c2cc2434b8002836a5e83e

    • SSDEEP

      768:c4UgWq/hHcO4x+BQC0WX57XDyaBNHVxYoAUQ/lX:c4fB8KBQC0kBTygVxLLqV

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks