General

  • Target

    e5fdda87b00736d8e26dc8296d28b4dba78a611a016314dfa375f7196062b504

  • Size

    410KB

  • Sample

    220520-3bhx2abeeq

  • MD5

    c0a73a4bf48a0a0d1275e92eddcff851

  • SHA1

    bb13ecbec1ef6f5d9dbc74b39a8c60a0e3ecddff

  • SHA256

    e5fdda87b00736d8e26dc8296d28b4dba78a611a016314dfa375f7196062b504

  • SHA512

    1275d6e477030d233e43b915be0429965e0a37a8430e92580850209a9069afb438145b1eac8dbe697eeeed6981778b2b0c7c169905716448089e62f0048038ae

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kohinoorribbon.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ashu@1976

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kohinoorribbon.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ashu@1976

Targets

    • Target

      PI for requested order.exe

    • Size

      478KB

    • MD5

      2680584211be8d5fb93057892e31ce33

    • SHA1

      0fa0c583d7fed58664f6bc6d419e7d0a107fb5fd

    • SHA256

      0bec6071e5185a2b3ffc0656e33da316380c56c12e807da02c28f4acad4a2fce

    • SHA512

      4f3bb4c0c7e77093649a908a38f56119f3e24c50298e2053b0eeae3606ffdf6580e1cc455267ca5e8759d0e48218342bb13da339085b82c8deded4ae018603b9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks