General

  • Target

    Scan_Document_Doc.exe

  • Size

    278KB

  • Sample

    211019-ddcrcsfbd3

  • MD5

    86d8f8fa859d11ac8a88e38dfedb8d96

  • SHA1

    c8d5464ed3413d4cf90dba99a8e96399d91b38da

  • SHA256

    eecf91e9544651e14a9d35d25fce7301aa9e94f77338bb246c5670448b485b77

  • SHA512

    a8d129f52f2968467a99d85ce972aaef2c32b9ab40744b9289e638155daa7849ab0bc37f55aefd477a7ac4b7c00fa989d107e7053ffafe3854f063411d135fe8

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2049702537:AAHkMlKpzDFOwF32VE8jmH1-TUEumKm518o/sendDocument

Targets

    • Target

      Scan_Document_Doc.exe

    • Size

      278KB

    • MD5

      86d8f8fa859d11ac8a88e38dfedb8d96

    • SHA1

      c8d5464ed3413d4cf90dba99a8e96399d91b38da

    • SHA256

      eecf91e9544651e14a9d35d25fce7301aa9e94f77338bb246c5670448b485b77

    • SHA512

      a8d129f52f2968467a99d85ce972aaef2c32b9ab40744b9289e638155daa7849ab0bc37f55aefd477a7ac4b7c00fa989d107e7053ffafe3854f063411d135fe8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks