Overview

overview

10

Static

static

3

Order Items.exe

windows7-x64

10

Order Items.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    536c3c7b283530131e7dafb623c6cc64e41e22bccec6ad78d01ea86da0aac7c5

  • Size

    629KB

  • Sample

    250124-bmh9dstqak

  • MD5

    368363ed9334b680637b2c8fe7a4ef57

  • SHA1

    7c5b326bac9816bf3bd9f52b32dc87e5eaf30d4c

  • SHA256

    536c3c7b283530131e7dafb623c6cc64e41e22bccec6ad78d01ea86da0aac7c5

  • SHA512

    8998ff5b9f6d60cff4c52a6f61f2c8102144237781337eb58f3a5143e9d712b2b8c6b3339754846db8a2a6d1b6058db0007caf6d9dea464b23e67bee1dbcf4c0

  • SSDEEP

    12288:Gr1qYUxZ12XN8bxbOGjmoE1YWWLsUJvwQAi8VjnVLKBbPK3PIy:Q1KZ0u8ApEd6wQAJjnVuPKQy

Score
10/10
agenttesladiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    w#chNV#1

Targets

    • Target

      Order Items.exe

    • Size

      749KB

    • MD5

      0e23ff638e20be5ad0cfa6fcdb90256c

    • SHA1

      9a44b604fe6a1b396d39952369ce123970749f0a

    • SHA256

      20d30752c1f8518e484b7f72333e4e1cbb5e61068837d46f16e6f4eedf08908c

    • SHA512

      b2ef07dc937b78cd8f7929b1b8f57f5c4b64091be5575b479c7c0c9ec0e9b3c9a6ccea9b9042d229065e8156a7c67e2f5981e725951a45f9cd932fec86091f51

    • SSDEEP

      12288:dfFtIu6U4/PTW7Z0KCnvP5axG0vwfpnOmAm/N+CB1nkhJ:dXIxva7ZQX54rmAmVtyJ

    Score
    10/10
    agenttesladiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks