General

  • Target

    4f292f3a32f19fbb2b43bb9defa01b89d010712ca518f2ab0e7d0fa76760aa01

  • Size

    654KB

  • Sample

    220520-2hvdzafdc5

  • MD5

    943acf4f3e96deb0f5e6484ff59b8d45

  • SHA1

    499fd80c2944d0b7c326bc23fb50f61f898db517

  • SHA256

    4f292f3a32f19fbb2b43bb9defa01b89d010712ca518f2ab0e7d0fa76760aa01

  • SHA512

    a78824b6db07f9bc87f849098ecf60f9f8b1ff0564fc62106e27e13767ce8ebdd255cd07892634bcef9955ed844b048bac176c51879861d20eec2d104371f0c1

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mmm777

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mmm777

Targets

    • Target

      Quotation.exe

    • Size

      687KB

    • MD5

      df9d06efd44cacfd15067deb44fb7d91

    • SHA1

      85dcefdefe1b612eb3d053721c3d475bc248787e

    • SHA256

      eb4900d71cfd218e3eb1eb920e96d4466796772830d964424ae42878ef9b2f8d

    • SHA512

      7f8bf4196e319da4415ae9c37ad1f3bab53ecff6255e80986d954468e460b889540aa3084506df30c037a4363ae4e5edfc0ea5adbe21e477e2bac10e7f9c47e7

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks