Overview

overview

10

Static

static

ORDINA_S.exe

windows7-x64

10

ORDINA_S.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Immagine--ordina settembre.img

  • Size

    1.5MB

  • Sample

    220920-knyj5sgagk

  • MD5

    7f88e19358ee30e03170a777c622e2ab

  • SHA1

    6bf400d1a8759f0221f9047cfe5b1d4dcbd12939

  • SHA256

    97ad468654f3dba7bc2abd067cae6afcb0b51133ab721f0a072f8b4cd6a04dae

  • SHA512

    3ac705b123a6f207181469b0facb8e5a537720f5f3b8a4fa3e84a15edbfa640c1e42a585e99af41beacff44700524ba8df22f478c35bd8aa1bfd3f9f97b2c4b5

  • SSDEEP

    12288:OCG0RMmsNC0B2k8c94mBQxcfe9vrv+8mvLo+fV8CLcYLN/HCk5FZiQ6ggJP:ObTLgkb94mC9vrUs+fV8kxHCk5Fl8

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    raphaellasia.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    student@1980

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    %2B
  • Port:
    21
  • Username:
    application/x-www-form-urlencoded
  • Password:
    image/jpg
C2

p=

Targets

    • Target

      ORDINA_S.EXE

    • Size

      983KB

    • MD5

      0cbe18c42b910d45fa81d8f66b912134

    • SHA1

      3a8faa42a6fa9afa3a2ce45950567ff9ebe3ebf2

    • SHA256

      d42754934013e057e09295fb49c30146a73742f23a0d89bfa711237f5cf74096

    • SHA512

      e05737c61a802c6a967e7d348862ffa89ee76de2a61d266eb8a57a2778dd3a37a669178f4c82805dd53808dad666ef4e1aab4b6ee333a432b81523808b45de70

    • SSDEEP

      12288:lCG0RMmsNC0B2k8c94mBQxcfe9vrv+8mvLo+fV8CLcYLN/HCk5FZiQ6ggJP:lbTLgkb94mC9vrUs+fV8kxHCk5Fl8

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks