General

  • Target

    8072bdfb9a676a266a81fdb810d98566a2f91f27999b570e947f5833c9573aa1

  • Size

    548KB

  • Sample

    220520-2d8qssacfk

  • MD5

    1fb3fe49a90d02aeadc90f9da341f664

  • SHA1

    13937fe3a9e965ac19c97ecb47a4605883a8babb

  • SHA256

    8072bdfb9a676a266a81fdb810d98566a2f91f27999b570e947f5833c9573aa1

  • SHA512

    b8b4ff31b502ae080d9d05fb3fd19d23b03638b384adcf2f41f1767bf63a53b6dcccdab02d3d5acbedd9edcfe92dc6f84481f8c32d4d4987199905703a3722fe

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    JuCbr%o3

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    JuCbr%o3

Targets

    • Target

      Bill of lading.exe

    • Size

      593KB

    • MD5

      88b1ed776af2c32d64529c23f609730a

    • SHA1

      27ab87c2efaf45ee82d3221378ffb83b426aca08

    • SHA256

      8019d96d218ff8d2250afacad9f154b21df4cbd3254ef8b9db7e710f07c73d73

    • SHA512

      cb3cadbf599b8c69f6293f76e3833aed2d8e0b76ab47002019706008030e7b1ebdd86538cebaf6cdec273f9bfb0e76d9b2be0032d5759426e8cf144ef7e9dd7f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks