General

  • Target

    0eb6ace677447a90426e41952fb973059eca4ea0526886bcac23f9571614d5fc

  • Size

    647KB

  • Sample

    220520-2nyzcaagbq

  • MD5

    67119aec4d1eeeab392ac4cd094923b4

  • SHA1

    1170de275c00bd36c9a27f89bdecca7bf3f92b86

  • SHA256

    0eb6ace677447a90426e41952fb973059eca4ea0526886bcac23f9571614d5fc

  • SHA512

    5958b29bde44bca0dad6684adac36179b3333428b4d89c7f4cd06759562482876d63f05d51e4b1defa86e4b73373bc4ee3d715d793bc6a24b6803f29b2d78348

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    server277.web-hosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OneLove123

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    server277.web-hosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OneLove123

Targets

    • Target

      F3015T3 PO 23800.pdf.exe

    • Size

      736KB

    • MD5

      897ecb029a7348998362ec00c76018db

    • SHA1

      131b0b8dffbfb84e10aa819278fb740748f843c9

    • SHA256

      616f7c08b834d252974745dba56f2a389c1ad7e8e31526d41579ea02f632d032

    • SHA512

      3f5fea2fba2e0bea9b17439b2da141309fe3148627f9c9f3797c9c444bb4b0f9ccc80207fc21709942a3307f103e3c8eeedee4796495d998f05a73775b83ed45

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks