General

  • Target

    olii.exe

  • Size

    270KB

  • Sample

    211021-rbjzjsbcdk

  • MD5

    ba9d3f63058ea4041190e82e03ffd5f6

  • SHA1

    2bd055abacc3b9ad6f7cb1fa8613c7c44fd21943

  • SHA256

    bfb35a39b72e24ce801468a629e64b1806ae5cf8339ade1ee7f145ec4497be93

  • SHA512

    7e2d37dd5921cda5ebff477308644b1a7f1b2586e6792f17d6f59b911dc04ed91db2569032dd9d5f3fa29e9caefb906153336052c256297354cfe73fc58b5462

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2046248941:AAG5Z0PyWwtApmPaysBm59voK10ec9Rgnaw/sendDocument

Targets

    • Target

      olii.exe

    • Size

      270KB

    • MD5

      ba9d3f63058ea4041190e82e03ffd5f6

    • SHA1

      2bd055abacc3b9ad6f7cb1fa8613c7c44fd21943

    • SHA256

      bfb35a39b72e24ce801468a629e64b1806ae5cf8339ade1ee7f145ec4497be93

    • SHA512

      7e2d37dd5921cda5ebff477308644b1a7f1b2586e6792f17d6f59b911dc04ed91db2569032dd9d5f3fa29e9caefb906153336052c256297354cfe73fc58b5462

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks