General

  • Target

    e71c20790ae9e91a10b1a7a9ec20654402d11c3f8f24a9ee48385da961baa79f

  • Size

    1.2MB

  • Sample

    220520-164rwaegc8

  • MD5

    5e234e80bf7335975fc860eabf12b2bb

  • SHA1

    bcc39a3d4201c4d6ada322dcd59aebf809a6e286

  • SHA256

    e71c20790ae9e91a10b1a7a9ec20654402d11c3f8f24a9ee48385da961baa79f

  • SHA512

    600bcebb03298fe9a2101f20d768a401869a3774425dc5b470746c49b838bc0284f851d39973571a37bbcaef24458ab8c96a40894f6cd3ab27bd70fc1325fe3f

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.orientalkuwait.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Operatingmanager1&

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.orientalkuwait.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Operatingmanager1&

Targets

    • Target

      JSW_NEW_.EXE

    • Size

      668KB

    • MD5

      de22b1990fa4f5205caae6bd67a0cf84

    • SHA1

      44c8909d92f225b28ec9c518eff7b33b88f51081

    • SHA256

      04a9ddb426b6bc9febd1f0fdf436cde01976a37b8c99fbbabbd0076ac4a0be92

    • SHA512

      7b41bf85a67b1ca989f9551a7ba162b22579c9decb7acf3a86cf801448148da5bb4a195edb33e4f6e0ae2be8b85d98c9305f90eceab1ab64b2d34f89a7807c06

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks