General

  • Target

    BL-SHIPPING INVOICE DOCS.zip

  • Size

    389KB

  • Sample

    211019-lv7basfef5

  • MD5

    092c3e277c0d8a846ab9f5183233e66f

  • SHA1

    1116e023916ac1b9bc106465b9971127c296cc81

  • SHA256

    fcf486671fcfd181aeeb5d964a0e5fce563be5b9a15168e8ee8ff11e2d6192fc

  • SHA512

    ecb1be28470ab77e8b3e08cdb20a1d93f4deb9f33dce306d291d1269be8b2205ed8cbb9f4d3e46c1ece976f27fcb08369db4f550d7dde5d091beae24aa67cd28

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.bsia.co.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    21mbsia@)@!Y

Targets

    • Target

      BL-SHIPPING INVOICE DOCS.exe

    • Size

      448KB

    • MD5

      1443ecb318ff158823692945f04e0a14

    • SHA1

      fba634c395ca7bf82496d04e5b45822611db65e5

    • SHA256

      fa9744a9f8530dfe050f21fd9b85a9cabfcfefd30b5290355e3ea6b6c8136b6f

    • SHA512

      ccc22d778f9369b3d38e9658216a1600602f951f7c437aaa6c1292f0bae7eb94dedbc3456cc0ce832a1f9f9ac2e11a58f8c459eb4a215d0b829ad6ae1da06aa5

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks