General

  • Target

    Order List SYINDAC_pdf.exe

  • Size

    778KB

  • Sample

    210128-gvlj5rsyn6

  • MD5

    8f3822b0efdca3e1e7f4b56ea55de84c

  • SHA1

    9ff92dd22877ae392fc8bd717916fb71198b913a

  • SHA256

    26dad1e44b5d06bcee5cddb288e3cd623da7bfd1d44a68661e27796f32e3de70

  • SHA512

    27d7fb388270bbaa7698fa1d8df8016e3170310fc0ec079f1af5a6e8766867019f6cd591ea8a96ed13f13aca123e2390eef503e9e852f6ea22010b79ab7e8e0f

Malware Config

Targets

    • Target

      Order List SYINDAC_pdf.exe

    • Size

      778KB

    • MD5

      8f3822b0efdca3e1e7f4b56ea55de84c

    • SHA1

      9ff92dd22877ae392fc8bd717916fb71198b913a

    • SHA256

      26dad1e44b5d06bcee5cddb288e3cd623da7bfd1d44a68661e27796f32e3de70

    • SHA512

      27d7fb388270bbaa7698fa1d8df8016e3170310fc0ec079f1af5a6e8766867019f6cd591ea8a96ed13f13aca123e2390eef503e9e852f6ea22010b79ab7e8e0f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks