General

  • Target

    fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959

  • Size

    546KB

  • Sample

    220520-3htccaghf8

  • MD5

    5bf584fecd24c42f858e4411fc329652

  • SHA1

    c5d014c14bb47ae233514edf051c6fc794165276

  • SHA256

    fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959

  • SHA512

    6a3476e5bdf867e2578d09381e67000e2e0a15be79035986bd2916af12d9d25bf23629420236a243dec5a918a1eb88fec2840bdbd32ee70c6b11156cd1ecca6a

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    webmail.volivesolutions.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    6@[B*n30b7SH

Targets

    • Target

      Quote 1-2#.exe

    • Size

      707KB

    • MD5

      75a63e23c47d23198061e6b11d317f39

    • SHA1

      e0282c323f307e8588f3d5e5a6f56c766ada725b

    • SHA256

      32c2766ee799eeffcfdff37dc5a1237b1c152f36b7108c4bd13c082db2d46423

    • SHA512

      9db43a6ce916b171ba891f4e76f102279769a0120a75803059f3e8e098e9b9fab0a712f6a171a9a310eb17e560471e32014c26693edaf4dfefcde9d69f3f7230

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks