General

  • Target

    Order.js

  • Size

    601KB

  • Sample

    240918-wgjm7avfqp

  • MD5

    0ab4c299c5cd500fb1ae69c2b3b449b9

  • SHA1

    fffbc3ff7a20e9b5ce7cba314988f78feba8818e

  • SHA256

    36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a

  • SHA512

    571a875e4ed34814eaf27bc6f174fb4ff27748336d2706f0b8c17428c83cc60639ec06f74d98b442a2f8eae01f0bc29469b413de7cf2e10ebbeb7d56ad0f50a8

  • SSDEEP

    12288:mMf1AA9a6oVwLkxbDt6P+B7Cg2KE073cN9mc9rf8FZ4UmlWT3GBBUUgn6QfCKUcj:lcVbdB7Uf/Ry

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg

exe.dropper

https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.detarcoopmedical.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    To$zL%?nhDHN

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Order.js

    • Size

      601KB

    • MD5

      0ab4c299c5cd500fb1ae69c2b3b449b9

    • SHA1

      fffbc3ff7a20e9b5ce7cba314988f78feba8818e

    • SHA256

      36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a

    • SHA512

      571a875e4ed34814eaf27bc6f174fb4ff27748336d2706f0b8c17428c83cc60639ec06f74d98b442a2f8eae01f0bc29469b413de7cf2e10ebbeb7d56ad0f50a8

    • SSDEEP

      12288:mMf1AA9a6oVwLkxbDt6P+B7Cg2KE073cN9mc9rf8FZ4UmlWT3GBBUUgn6QfCKUcj:lcVbdB7Uf/Ry

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks