General

  • Target

    ORDER.zip

  • Size

    482KB

  • Sample

    230330-paw7daea31

  • MD5

    293c05d66a76bfcb888efb06a62a28a6

  • SHA1

    b9a33b0d03ad536eb3a2a2b3ad580c76f9d61725

  • SHA256

    4241d1aa7d78cac68f1c04600bbf4eabe31e6dc3dafc493657a8ae1197939dd7

  • SHA512

    2f2bcc9f9941f7f4737971abd73ee003f460dd5f3ec80c98329d717ea4b0e0dbb8b221134f95a41876c729eb27e65da7cf85cd4831a8ebb01466388b226eabcd

  • SSDEEP

    12288:hvTiqu42mOMHQbGeGnuih+MGcUheRTzRHi:h9ulVbrRK+MG3eRTE

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      ORDER.exe

    • Size

      709KB

    • MD5

      bf7e3ea1bbaba155ce9079dc9e959501

    • SHA1

      be73007a9ea47dcd70ad4c17f239a78c709829d8

    • SHA256

      8107f9ab5c5030afbbbebfd98280556cc08697cffa66d45548c5e012209d9184

    • SHA512

      ee89bdfd7557ef43f705c5a14e01bbbda3cac74d3ef14361cb4ebe9b45afc22be2e437acc68886abb92fcad8e9145f205956f7c23c348a625f79e28b9ad600c4

    • SSDEEP

      12288:hxBZWR942mwMHGtGeIn+ihCMGkU0yywVn3:h1WR9lptrNKCMGIwV3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks