General

  • Target

    Elite Quote 20212510 PO Xlxs.lzh

  • Size

    596KB

  • Sample

    210927-ayakysfdh8

  • MD5

    30dd6877a85131f81fda14e523f591b8

  • SHA1

    d44098bc9b26848597a9f79d27ca81607492bbb4

  • SHA256

    c06be9059a226e53dfa4715249dc71fa6c03ec578a792a05f9ae45fd1d026e58

  • SHA512

    d620c9d16b9acc46ed8337e9392c695fd8231ff72ae6d623199d2d7e10da0bd6946bbdd772bf09c360137bab53e928101b2898d675cb168de37c58a8b0d3b981

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.mmdqatar.com/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    Mm.101010

Targets

    • Target

      Elite Quote 20212510 PO Xlxs.exe

    • Size

      1.4MB

    • MD5

      0c90b42b697dbdb5962ba603edfc24e8

    • SHA1

      18deef81deab0dc3580416bdc67590f0405f0da5

    • SHA256

      24b60008050f342ffb0e3456dd968c6cf51d1d6b7ebaa55a913121eba78dc29b

    • SHA512

      ac69ff2a2508f0748520aba70c0143d62064659d847e09df31fd274fd208f0d748595af1a021c33ea29868a20b70313826ab4c2b583b6455781bf7e4cb05150f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks