General

  • Target

    202110207367475849758.PDF.exe

  • Size

    28KB

  • Sample

    211020-arrkwsgdh3

  • MD5

    efc321c36f4e1634c063378e4c3b3918

  • SHA1

    97761a7e2ffa6fb8948184c2091099c681261a79

  • SHA256

    17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f

  • SHA512

    c2c9086b2d95efab45527cdddad2ebafd5a3c4196a897e0ca111f43c50778d9468d444fe3573e717a3e44eebbd84c5fb1b6d6842f27f505ab5d9192d23ec0c2b

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    LOG777@@

Targets

    • Target

      202110207367475849758.PDF.exe

    • Size

      28KB

    • MD5

      efc321c36f4e1634c063378e4c3b3918

    • SHA1

      97761a7e2ffa6fb8948184c2091099c681261a79

    • SHA256

      17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f

    • SHA512

      c2c9086b2d95efab45527cdddad2ebafd5a3c4196a897e0ca111f43c50778d9468d444fe3573e717a3e44eebbd84c5fb1b6d6842f27f505ab5d9192d23ec0c2b

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies WinLogon for persistence

    • AgentTesla Payload

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks