General

  • Target

    GD-5401.doc

  • Size

    774KB

  • Sample

    210111-53db6d1rx2

  • MD5

    ea321a68166c836d5902a47b29e2f210

  • SHA1

    f9ad57857822407355ad8274a77707121719eaae

  • SHA256

    aaa18f0745796abb7833024b664413a4859e12f2350ae17a47439a442d0ade04

  • SHA512

    6e3c8a94991bbd55e08a67ec595744b6684d1f90a02064888c6a8224bb70f98fd740145f811a90d9a2adad7a8237a326204421f0a69c2817b729cdc3fef586ef

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    novget.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    0l7PKJauRv

Targets

    • Target

      GD-5401.doc

    • Size

      774KB

    • MD5

      ea321a68166c836d5902a47b29e2f210

    • SHA1

      f9ad57857822407355ad8274a77707121719eaae

    • SHA256

      aaa18f0745796abb7833024b664413a4859e12f2350ae17a47439a442d0ade04

    • SHA512

      6e3c8a94991bbd55e08a67ec595744b6684d1f90a02064888c6a8224bb70f98fd740145f811a90d9a2adad7a8237a326204421f0a69c2817b729cdc3fef586ef

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies WinLogon for persistence

    • AgentTesla Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks