General

  • Target

    Proforma_Invoice_CNIC109908_pdf.exe

  • Size

    463KB

  • Sample

    211202-n8836afhaq

  • MD5

    7a512365c3d8af5c082d0d6598969153

  • SHA1

    b2cb0b6042bda317a9be63128e612e4014ac4475

  • SHA256

    a13e7df444d6f5105bb519d6167b282aff4d3ba90801bada293d0ea83e2590d8

  • SHA512

    9738ccf59313d8f59dd7125db73fc6a9301a5499f9fb0d5b939c2212c006c3383e33c473d9f092a4f5b8f604ce6c847853ff4b918f75ec96b17455d934b0134e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.huiijingco.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    zVYrdtq4

Targets

    • Target

      Proforma_Invoice_CNIC109908_pdf.exe

    • Size

      463KB

    • MD5

      7a512365c3d8af5c082d0d6598969153

    • SHA1

      b2cb0b6042bda317a9be63128e612e4014ac4475

    • SHA256

      a13e7df444d6f5105bb519d6167b282aff4d3ba90801bada293d0ea83e2590d8

    • SHA512

      9738ccf59313d8f59dd7125db73fc6a9301a5499f9fb0d5b939c2212c006c3383e33c473d9f092a4f5b8f604ce6c847853ff4b918f75ec96b17455d934b0134e

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks