General

  • Target

    Order_PO EM212843.zip

  • Size

    474KB

  • Sample

    221123-p7hegsdb87

  • MD5

    7fa84662bea05257d91ec27e92495f6f

  • SHA1

    caae301c43cdffda388c94df2022a7a732bc9330

  • SHA256

    6eca2997c05f3312f3e704ce4363c74f3ba575ab0166dd6d16b5f5e6611cbfa5

  • SHA512

    c59591c478b753e55aaa82d2ea479b57a212f6c3678278dacb7b013ec1f15b264f9b804df5b8264c5040a5f002ec3b30e7ff4befc0a4dfd822af388cc3c653f1

  • SSDEEP

    12288:cn4xouOWe4Bcw7loOy+7OoGDL846WF9kB0gVL:cn+orOBrh9y+y3DLZFQ7VL

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Order_PO EM212843.exe

    • Size

      572KB

    • MD5

      e10777c560dcacc0537c588c2999bd7d

    • SHA1

      127b2a6444a323070ec31643dabfa3803ffe2ec5

    • SHA256

      5b72b74c569f9a1593b4bf313a02db7e10f9e8ffb5ed73ee73ed76b1c53ad13f

    • SHA512

      9339898e57c77be6966a1cab1fb39860b720e762fabcbfc8c21ebf5d3995b4c907910536eb0415a404dce2e9d06dc5176d2ef6b8e1620370556798a7825eafb8

    • SSDEEP

      12288:Ox3aWpUo67IMwM8yzwElEkj76s4DSABfUnNI1ic6DlQOys7OoG7P8M6cFmX3Z7i:l6s4DSuUNEiT5Fysy37PjF6l

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks