Overview

overview

10

Static

static

PURCHASE ORDER.exe

windows7_x64

10

PURCHASE ORDER.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    490f3b52a176c716bd0d0dca765b983e47b76c28b70e328f3e02d098540bf73a

  • Size

    916KB

  • Sample

    220521-awv4waahc7

  • MD5

    e31cabd7a08ec8756645ed362a41924c

  • SHA1

    c3e6fa7edc766755625fc8e8dc95812757486fc4

  • SHA256

    490f3b52a176c716bd0d0dca765b983e47b76c28b70e328f3e02d098540bf73a

  • SHA512

    7f590b9da07592bc208ad377b3410f7465eebfa2662fa6f60fd7a1ef47c93cea177ae8ac1fab996a4502926c6692b63dc97ffcc00399b7df36ca85cce7565488

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    connect

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    connect

Targets

    • Target

      PURCHASE ORDER.exe

    • Size

      854KB

    • MD5

      925ec4c511aef015d943d357fed38a78

    • SHA1

      0d95b2c91d39b0c779a6b7c20aae5352b410f3f5

    • SHA256

      07424ad0d92da73a502fdc7ad3c67ee6a7e882cbfd3abfad1cf4f33c4b5e4597

    • SHA512

      bd5ebb1046e5378b9450d51e9d9931de6610ae5e00d62a028b9e4c058545ea858184a7699e65bfbe76d1c4b2c7f2e08a83e4ab621f67e8b341166e786a48d56f

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks