General

  • Target

    New Order.pdf.z

  • Size

    288KB

  • Sample

    230613-hkw6ssfc28

  • MD5

    89689dc72ee93b6047f83c14adfe3908

  • SHA1

    a1360d85acf7e4a281b32daf3a656fc3be12372b

  • SHA256

    4f92ad986f76bd24284b367ac88db0e63437ebd35559e4942b1ee1c35a7ef5d7

  • SHA512

    a7126554695b54c9c6739ac066aa81cb6e13a5d2320d537df2067f813dcc538f22d7a4e0d5c7d78e1214a4c1344fe8a81294de61a42e060326c734b422c70441

  • SSDEEP

    6144:2d14bEWhA5/ZgH8QWcrQPhIuF0HR8iV0oanece9Vq:2d14s/qH8QWcrQPOZHR8iVTseLvq

Malware Config

Targets

    • Target

      New Order.exe

    • Size

      330KB

    • MD5

      af91bd1a0af069b39b3293dcd50bd4fa

    • SHA1

      9ff4d3d6a7f355d9114dfccd620c614ab4b2632e

    • SHA256

      97ad8dbd6e1db83248c8ca803510f18477375e1b5ef37d7cf2811ff565346c09

    • SHA512

      ca7289f92b3f0c1865eb3c537ef1580860c59af744656461c7d22487be0500ecbd75b93c29ecf82ffd4eae3e1556759db1562f7260944ddbeb1931224f5ea734

    • SSDEEP

      6144:wYa6RQq1CWmEkBpbf5VNuFOuvsWn4LVpikZ4jKyxza0Q8QvNn:wY3rADN4b5nWLKjR9W9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks