Overview

overview

10

Static

static

ORDER.exe

windows7_x64

10

ORDER.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f532ffe156d2acf010955482d55d18b832d6e80344e05899f37a52a9ca0319b

  • Size

    1.0MB

  • Sample

    220521-am19jaddeq

  • MD5

    bc2d741954ea0ce341b6722c2e5412b7

  • SHA1

    c6a74c2176e36a52bd584ebd632470d983a03d48

  • SHA256

    6f532ffe156d2acf010955482d55d18b832d6e80344e05899f37a52a9ca0319b

  • SHA512

    8b06a8aaf48be841b6bb297463bc7c367ec28bbce99be839ccea706439c096ec9654e26d720e350fbc2a02f7b5f9adbd688463ac1ded6077eef1b29f7b6bc1db

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    *Kwr3hv#4X@h

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    *Kwr3hv#4X@h

Targets

    • Target

      ORDER.exe

    • Size

      1.0MB

    • MD5

      87ddc6eee1b65cbc32de5dffb02e7a29

    • SHA1

      d1e2e1e71ce118421e5d110e84c576ec530fb960

    • SHA256

      bf70be02e2965f32ab1dd7337adf8c292110f33236c501d4c6a39f775b626cf6

    • SHA512

      2094537d29119c28df54659103da545f80df080a6e2826cb1281aed8f129eeb75969dfaad38a1f1cab0cf5f759cfed610c0ed180d3719269c0e92be4c6a63e2b

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks