General

  • Target

    02f546ccde1ea022a6cc1fe79459313fbe60febce49aa33535f51d7308e5ea8e

  • Size

    331KB

  • Sample

    220520-2pp3tsfgb3

  • MD5

    61799373aad307069f2a08efe92e8626

  • SHA1

    1696fb5bffb20c343d809bbb809edd885741b2e3

  • SHA256

    02f546ccde1ea022a6cc1fe79459313fbe60febce49aa33535f51d7308e5ea8e

  • SHA512

    5759bc773e3c3853d272ca76e5ecba91140873a2382edaac9e3e57116081c557413eb1a1c6dbc744e43173590cd3997bf0ca0587dc136df324e22c89710cd12e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.mexicanproduct.com.mx
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Produccion2020.

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.mexicanproduct.com.mx
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Produccion2020.

Targets

    • Target

      WT0045679.exe

    • Size

      348KB

    • MD5

      62ed509fb1d4970cdce54f932c62f183

    • SHA1

      a9ad23ec52ed7a577cc7e3ae3136b9386b29793c

    • SHA256

      6e5534bae3f5c22467266cc1921253fded33437267b0f8b469bb17282c52a4f2

    • SHA512

      bb72fe936402a70f7b6e7be9d0dfd80011e668a34cdad12b4407c4fa6f1f65e98b5766a2e693172cfbc7a4984910e50d255392b944d4931f73f27ae6ffb0a453

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks