General

  • Target

    c47fa682104359755b8869fa308610acdccd3f58a4bdc237b2bf35d3b3dee464

  • Size

    492KB

  • Sample

    220520-19ft8aehe9

  • MD5

    d688005f2ffe581b7e270f2a20f36cc4

  • SHA1

    f15ca4b13b9a3c5c9351b1547603e9dd4f42fce3

  • SHA256

    c47fa682104359755b8869fa308610acdccd3f58a4bdc237b2bf35d3b3dee464

  • SHA512

    67d62e28e42c2be1d615a9ee17930e109a90f12a3dc969f6a0cc7fb215b6cf8927a309d627a7c291c776b3cc509b7745f01a62a5602760447beefd76aae076a4

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.buiwei-wpc.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Nigeria111.?

Targets

    • Target

      Product List 002190.exe

    • Size

      580KB

    • MD5

      fae687b07b9f66c1ef234997b1eddcf5

    • SHA1

      fd118a14013ebcd32ddf0bd51dcee7ecbbd2e9a3

    • SHA256

      7ed7208dfa92550e6dba4b98ced2dece328e230f4e57f4981031d172cc12690c

    • SHA512

      505177b314cc653bf7109d0d71394dd442c10ea7fc806a9766c898219423371136a06401d1c00c26dd22fb9cabe6df847d3a37746d1e99fce92d288c701c8426

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks