General

  • Target

    New Order.exe

  • Size

    666KB

  • Sample

    221128-ltcejadg47

  • MD5

    06895d8d4b00033cdbb39b9daf6612be

  • SHA1

    2ec7c298232968f81d114dd7e693f8823190cbf9

  • SHA256

    d73101ab17bc879d736d035c6272beb309d438e3c0e248267b33dbda210242d8

  • SHA512

    dbf342e9c401944fdfbb908593ccdf73fecfa1b61949b96396e629c20a3ac287a450b54cb92a043a96161f1a0a84ecd45ad93d00a2cf02df49af2bf57dc8fd67

  • SSDEEP

    12288:QYcmpbKbfZLRzS1V7VfGg5T9SCmejJmYKQ16coH+:Qr0bKcVJf/hpmeIY/zo

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    host39.registrar-servers.com
  • Port:
    587
  • Username:
    Emenike@potashin.us
  • Password:
    })cZs aj5Xr; C

Targets

    • Target

      New Order.exe

    • Size

      666KB

    • MD5

      06895d8d4b00033cdbb39b9daf6612be

    • SHA1

      2ec7c298232968f81d114dd7e693f8823190cbf9

    • SHA256

      d73101ab17bc879d736d035c6272beb309d438e3c0e248267b33dbda210242d8

    • SHA512

      dbf342e9c401944fdfbb908593ccdf73fecfa1b61949b96396e629c20a3ac287a450b54cb92a043a96161f1a0a84ecd45ad93d00a2cf02df49af2bf57dc8fd67

    • SSDEEP

      12288:QYcmpbKbfZLRzS1V7VfGg5T9SCmejJmYKQ16coH+:Qr0bKcVJf/hpmeIY/zo

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks