Overview

overview

10

Static

static

New Order.exe

windows7_x64

10

New Order.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order.exe

  • Size

    412KB

  • Sample

    211018-tmyyysehap

  • MD5

    5f546d983398118492848fbd6738e005

  • SHA1

    77d3a30309ecd1095118d49cd343dd6d82be592b

  • SHA256

    201e4f71a185f6b79203ad873cc5abbbeb85f1b11a23615403bcabcbb13932d1

  • SHA512

    de2a620945b8758fde36b91736cd05d1e301e0163040528532c49bc3a2f3bf0f3e5959a61b8b60fe5bacc72330218c6ea926f03427011e0dee1337de2ae2aae7

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    e)cnIdR1

Targets

    • Target

      New Order.exe

    • Size

      412KB

    • MD5

      5f546d983398118492848fbd6738e005

    • SHA1

      77d3a30309ecd1095118d49cd343dd6d82be592b

    • SHA256

      201e4f71a185f6b79203ad873cc5abbbeb85f1b11a23615403bcabcbb13932d1

    • SHA512

      de2a620945b8758fde36b91736cd05d1e301e0163040528532c49bc3a2f3bf0f3e5959a61b8b60fe5bacc72330218c6ea926f03427011e0dee1337de2ae2aae7

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks