General

  • Target

    b685c8e356a07606e23b77007689360a1e881e701ebd52ede718fae2bb480457

  • Size

    432KB

  • Sample

    220520-2ah1zaaahp

  • MD5

    8a8f26df40a837c16753e2bfd57ed1d0

  • SHA1

    7dc3a81dbdec71819ea41f7a36862e38178caa8a

  • SHA256

    b685c8e356a07606e23b77007689360a1e881e701ebd52ede718fae2bb480457

  • SHA512

    f3dd383655f8914977967d4dfbc76283949ce5920daec7f0b0b2cdf22c1c55052226bd7a9a81662bc2c8209835d4ff1647ea9dec929ec00251e7fee7fd86029f

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kateojo11

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kateojo11

Targets

    • Target

      PROOF OF PAYMENT.exe

    • Size

      519KB

    • MD5

      bc148c6c959e683bdb35eb8082de1348

    • SHA1

      d6112abc878ef884111e8cb2c3bd08a16c86e7f0

    • SHA256

      169841b0663caf89087ba42112cd8a2ce6f7ef0fa0da0a7124e74547031cc362

    • SHA512

      641668dda8a5fa08a6dce837cae8781dd232b65966cdef0bffa1b845db41cce4cb3fe5357aad144cfd32cc2c12ffd45c03504586839d4dbbf0646ac10c07af5d

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks