Overview

overview

10

Static

static

new order.exe

windows7_x64

10

new order.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new order.exe

  • Size

    580KB

  • Sample

    201109-dfm5avre9j

  • MD5

    84f8ac889156643db3a5fbfe7eb85cb3

  • SHA1

    0424cd2eb37161e18087717362c2de57dfc91896

  • SHA256

    aea995774e042d4c1aba6b954eb0e771548f7edb16c4d46c8cae3dae99ce7bc1

  • SHA512

    760aa5689b1092519f9dbfcb2c25672d885fc4eb0e7ae4c384a97d6c1f9d358ef3ad710c6ff0f774fdfe66ec1e1c4b24eb390a86b63f6e085cb95b8730750bd6

Score
10/10
agentteslananocoreevasionkeyloggerrezer0spywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.rajapindah.com
  • Port:
    587
  • Username:
    rizky@rajapindah.com
  • Password:
    #r4j#citeureup#13

Targets

    • Target

      new order.exe

    • Size

      580KB

    • MD5

      84f8ac889156643db3a5fbfe7eb85cb3

    • SHA1

      0424cd2eb37161e18087717362c2de57dfc91896

    • SHA256

      aea995774e042d4c1aba6b954eb0e771548f7edb16c4d46c8cae3dae99ce7bc1

    • SHA512

      760aa5689b1092519f9dbfcb2c25672d885fc4eb0e7ae4c384a97d6c1f9d358ef3ad710c6ff0f774fdfe66ec1e1c4b24eb390a86b63f6e085cb95b8730750bd6

    Score
    10/10
    agentteslaevasionkeyloggerrezer0spywarestealertrojannanocore

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • AgentTesla Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks