General

  • Target

    9A118F214B5C3906A5A88D325FC36D8B.exe

  • Size

    4.0MB

  • Sample

    211123-fkvlvshcfn

  • MD5

    9a118f214b5c3906a5a88d325fc36d8b

  • SHA1

    962bca3f6acdb1d88274b4c61cfb1a987758c3a3

  • SHA256

    d736600bb69d2649cb7d8e7df884063266fb9d0ae97e284b038c80563e7df645

  • SHA512

    d3cdb66deb1fe9103b67ba7e53255623b9ee9188c87fd5bd0c44944028d5d54035ccd0886566f337e15785eb1c0410aaf8b2fe2c8f94b36174cb9eadabc23c8a

Malware Config

Targets

    • Target

      9A118F214B5C3906A5A88D325FC36D8B.exe

    • Size

      4.0MB

    • MD5

      9a118f214b5c3906a5a88d325fc36d8b

    • SHA1

      962bca3f6acdb1d88274b4c61cfb1a987758c3a3

    • SHA256

      d736600bb69d2649cb7d8e7df884063266fb9d0ae97e284b038c80563e7df645

    • SHA512

      d3cdb66deb1fe9103b67ba7e53255623b9ee9188c87fd5bd0c44944028d5d54035ccd0886566f337e15785eb1c0410aaf8b2fe2c8f94b36174cb9eadabc23c8a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks