Overview

overview

10

Static

static

3

Purchase O...43.exe

windows7-x64

10

Purchase O...43.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Purchase Order.5643_1.z

  • Size

    635KB

  • Sample

    240119-pabwfadeck

  • MD5

    71ee28e641e8543a7166e7b7829f626a

  • SHA1

    d05779ba733695a72d1aae07f85060be43cb33e4

  • SHA256

    66ce3d5a63db911268b91daa47e622f870a8390f60122ba6109fa9671ba7ebf8

  • SHA512

    ea590d91f1773aeb071998e8883272a4a3e5757ffdabf93329f43348e13ae0a39a37e4a229bc693a22494d81d09f0ecd79e22cd8eca7dea0179c2bc55124ee46

  • SSDEEP

    12288:qjVUyvGsa9pPfrFA4pMSfa19srueXShRl9wVwCC1kaWH:4VUmta3PJA4i+AGNXShXe22r

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.cornery.com.my
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Market321*

Targets

    • Target

      Purchase Order.5643.exe

    • Size

      662KB

    • MD5

      8b3abee5036c5743451fc819fd29b3e0

    • SHA1

      2fe6602e1225ce57e9e98e64224a2266f74be32b

    • SHA256

      dd0b5229472bbf201622f50701c2b01a68ebddf452d14c06beba8cd755cf33b8

    • SHA512

      d9bd614d97ececdf8b0f4faf6541e30dbb261b457b2b67d5bde5c1356886f238d0bc652120068c0d9e065ac2cd35948c0c9008e17303c76386609979e329c06e

    • SSDEEP

      12288:f+dCiWyoh2hJBDLhVtH8Hby8dhNOQtzGfmap5XOO9ePFLVoq3FwB:fyuysKJZJcfFhKbjXRePRVoMF

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks