Overview

overview

10

Static

static

10

ORDER 990147.exe

windows7_x64

10

ORDER 990147.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER 990147.exe

  • Size

    1.9MB

  • Sample

    200716-9b5d2p8tp6

  • MD5

    e2a0002b049572d2ac4a40a1b01e412d

  • SHA1

    dd6219c8208e6b18ce859856e294eb89b51b24af

  • SHA256

    3d0a1e494ae5a0cbc4075f7cbdb2421e4840da06cf3ea998d588928c841e9713

  • SHA512

    0a10ceff96f08748060cc4357a6654cd0c54041f7c912a7815e180114a1b39664dbd5d38a3e30a011cd19e3fb2ee5d13fd9a8e2bd1f1b7ce5a7e7b6965340de5

Score
10/10
agentteslamassloggerkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      ORDER 990147.exe

    • Size

      1.9MB

    • MD5

      e2a0002b049572d2ac4a40a1b01e412d

    • SHA1

      dd6219c8208e6b18ce859856e294eb89b51b24af

    • SHA256

      3d0a1e494ae5a0cbc4075f7cbdb2421e4840da06cf3ea998d588928c841e9713

    • SHA512

      0a10ceff96f08748060cc4357a6654cd0c54041f7c912a7815e180114a1b39664dbd5d38a3e30a011cd19e3fb2ee5d13fd9a8e2bd1f1b7ce5a7e7b6965340de5

    Score
    10/10
    agentteslamassloggerkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main Payload

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spyware

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spyware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks