Overview

overview

10

Static

static

Purchase Order.exe

windows7_x64

10

Purchase Order.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18

  • Size

    452KB

  • Sample

    220521-nx7qysece9

  • MD5

    852239424be81f0464683f9dafade49d

  • SHA1

    03ff5973da6428080908426a3556d1ca935a548c

  • SHA256

    ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18

  • SHA512

    604ac65b590a9742f3ff6367712f57f476829d633860441964ece5d918444974f47e5c3e1188716b0ef4c542d8aff1e930bb54813d8077f482992ab84830e15f

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.amexworldwide.com
  • Port:
    587
  • Username:
    sujit@amexworldwide.com
  • Password:
    sujit@41#

Targets

    • Target

      Purchase Order.exe

    • Size

      518KB

    • MD5

      8feb32e81b0c570b023e62ccaa62459b

    • SHA1

      1d31d28aceb106ee34ed91e17b7d6b26b5bd4025

    • SHA256

      66a821494ff2c4e9d5dbe663572f4f46df6993b0a661a29cd4a3da18414b9527

    • SHA512

      be8bd41f5ff1b93dd7e8f4171a8158876b9f2db3ad13471ed76a10c57ae89782d45b80d8ccd9a23adda0b5002bc3f97e52ecfbf054838fd01db024c5b65041f8

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks