Overview

overview

10

Static

static

Purchase order.exe

windows7-x64

10

Purchase order.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8D810FBD4A4F89F075F6A69784928C8D4B4C5B549ED32606D5522790D062D474

  • Size

    633KB

  • Sample

    221123-r2ccdsda8z

  • MD5

    6f0f59a7fa9ea60b6b3b83f4d232ba6d

  • SHA1

    0c015c83f1422fff77d83a809d474cf2bf0a26e9

  • SHA256

    8d810fbd4a4f89f075f6a69784928c8d4b4c5b549ed32606d5522790d062d474

  • SHA512

    8fee3afcf727ae590a5f63c7a0e869484b98f322cb7b57469d8c2cc051a6de9fa3aec7bc6544ec19bebb9d9242c2c329017e754a6a0fc813cf0b42b93de38a84

  • SSDEEP

    12288:vR8LtDyDDjVE8biUod/cEkaSH23iznIahBGE5KuweBsPJx1MZ8ed8NN:p8LtDySmsdA/GiDyJDMZ8e2NN

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.chamakiotis.gr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Fyr2q?93

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.chamakiotis.gr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Fyr2q?93

Targets

    • Target

      Purchase order.exe

    • Size

      699KB

    • MD5

      71473173f728c0ae8c921000619d3950

    • SHA1

      dca46a8b23db8f8556858ec18a71a4ef4be9df60

    • SHA256

      c042e3d59aa2845f1812cd9b172946cfb60207f81f8faa7350446140ff6b4549

    • SHA512

      f07f46b1459bc2db3a65a473d055e655e2e8f98443feb5274e6ba0a3873f4f7a13a2fbd59ac5e261649fc525cfdbe58271bf7f1977ac2838072152245e697e19

    • SSDEEP

      12288:2jcWtGDCBpQW7LFc2lI1tmPSbouyoN9bkvzAt08CyqXT:zGBpxB0tmPSNVUCSXT

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks