Overview

overview

10

Static

static

new order ......exe

windows7_x64

10

new order ......exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    new order TRICOLOR-6.45 TRICOLOR-6.3 TRICOLOR-8.1 TRICOLOR-7.66.......exe

  • Size

    549KB

  • Sample

    211202-rrwy2shfgp

  • MD5

    66cbe976594f666d5440264a4084b21f

  • SHA1

    944c8819e41ad59333527141a7fd5180253969e1

  • SHA256

    460eb4667362671be2be1e94afe56e73331c3a3cd58b028e49ec135fec8888a9

  • SHA512

    1ebb035fd7ceab82f4ee270e66b097958e8b57805897dcafc4736e82e64961ec5df61af8a0ec78d9d119d2ec235d955559cfe360587e46915aa9c5450c93da1e

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.kyowasecurity.com.sg
  • Port:
    587
  • Username:
    marketing@kyowasecurity.com.sg
  • Password:
    avKw1$991

Targets

    • Target

      new order TRICOLOR-6.45 TRICOLOR-6.3 TRICOLOR-8.1 TRICOLOR-7.66.......exe

    • Size

      549KB

    • MD5

      66cbe976594f666d5440264a4084b21f

    • SHA1

      944c8819e41ad59333527141a7fd5180253969e1

    • SHA256

      460eb4667362671be2be1e94afe56e73331c3a3cd58b028e49ec135fec8888a9

    • SHA512

      1ebb035fd7ceab82f4ee270e66b097958e8b57805897dcafc4736e82e64961ec5df61af8a0ec78d9d119d2ec235d955559cfe360587e46915aa9c5450c93da1e

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks