Overview

overview

10

Static

static

New Order4687334.exe

windows7_x64

3

New Order4687334.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Order4687334.exe

  • Size

    792KB

  • Sample

    211202-q892kahdan

  • MD5

    abc0d5990e243c73bcb0ef52f113c9c8

  • SHA1

    a62d9e6614ab925a6ec5ec1d8c8abeb44cf51ef0

  • SHA256

    b8baaf727f8da89fe81122fd5c93c3d34b7f3f78ae90403309d7d335e0bb3792

  • SHA512

    c33cdb17d07af0b51b4dfdf1a4626ec94ad87d24aef2e4ac8cc17eecdfdfe246224a28e448d321feb4ea70d83a349f822ed46abad7ec1913566b83a2c9bc4fa5

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5074572303:AAE8ZKRzrDBFdUptPX0s5TohA3XJtaS_H_8/sendDocument

Targets

    • Target

      New Order4687334.exe

    • Size

      792KB

    • MD5

      abc0d5990e243c73bcb0ef52f113c9c8

    • SHA1

      a62d9e6614ab925a6ec5ec1d8c8abeb44cf51ef0

    • SHA256

      b8baaf727f8da89fe81122fd5c93c3d34b7f3f78ae90403309d7d335e0bb3792

    • SHA512

      c33cdb17d07af0b51b4dfdf1a4626ec94ad87d24aef2e4ac8cc17eecdfdfe246224a28e448d321feb4ea70d83a349f822ed46abad7ec1913566b83a2c9bc4fa5

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks