General

  • Target

    Order_0720PDF.exe

  • Size

    708KB

  • Sample

    200707-w67h698pza

  • MD5

    bb74242d80d141d6314cf151c7db88db

  • SHA1

    ed713dd9f9d036801b328ce98d66f76bfee3e19a

  • SHA256

    7a6ca5fc154848fb338acb8c6ed9643b99d94df75a198133cf779353a84014b1

  • SHA512

    220c444d9f1fd136f9db6650a1796bcdd8285de17400e8286814d5d0754f6bdb69d472d8bc2be32c78211e185bde9b4257629ac085fee415af9da9bf4bdff18a

Malware Config

Targets

    • Target

      Order_0720PDF.exe

    • Size

      708KB

    • MD5

      bb74242d80d141d6314cf151c7db88db

    • SHA1

      ed713dd9f9d036801b328ce98d66f76bfee3e19a

    • SHA256

      7a6ca5fc154848fb338acb8c6ed9643b99d94df75a198133cf779353a84014b1

    • SHA512

      220c444d9f1fd136f9db6650a1796bcdd8285de17400e8286814d5d0754f6bdb69d472d8bc2be32c78211e185bde9b4257629ac085fee415af9da9bf4bdff18a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks