Overview

overview

10

Static

static

3

PURCHASE ORDER.exe

windows7-x64

10

PURCHASE ORDER.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d45761cedab312c04a4786ca195da76c1906f1fcd23e1cf82d1554767c319f3

  • Size

    637KB

  • Sample

    240329-blmkesde9y

  • MD5

    3622ba7cc273fd1fc9ded2c88ad27ddb

  • SHA1

    203f6b9b7794ba1bd292ec6a337529a6ba88ac62

  • SHA256

    4d45761cedab312c04a4786ca195da76c1906f1fcd23e1cf82d1554767c319f3

  • SHA512

    fc8b472efe86b5af2719f9d34ae101f8ef51c9e98da35c9403b8ff91a57b23ad6ece896478141432142cb7de1f2a2de50c099fa9945aa0b21156179fe31b9b70

  • SSDEEP

    12288:iYSR+lNfIAZlpnxpSsr/8/vwdfiynr+LQyufUo4BdsSteW:k+LlR4MMLQyufGtteW

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.shivomrealty.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Priya1982#

Targets

    • Target

      PURCHASE ORDER.exe

    • Size

      670KB

    • MD5

      82ed2d50defbaa3056e1216f7a04fd29

    • SHA1

      b0c53c84b62236adb6dbe7adad055e13c6ff58cd

    • SHA256

      5367bdd7476c6a1d2ac38b0d8efcbaba0c74176f86cc0f76e925407e62605071

    • SHA512

      550d35d6c2dae4cf1d818a5d6d77d9359cdf4420d1dcd831cd39c179bacaf441800afe11d0961f8affe718f349d0aed92816c4b8d0c15a95231a7dad453e9356

    • SSDEEP

      12288:sme0YOwq0IDzlpnjRSsrj65vGdaM6Ge/zqdrAamH8Wss:+O70I3lbBaZo6a3Wb

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

4
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks