General

  • Target

    f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a

  • Size

    463KB

  • Sample

    220520-3jlznahab6

  • MD5

    4f0346d7c33e5be3f3e2a9b1718cb748

  • SHA1

    9559a77455572af0df1f26f14232c5e8db03427e

  • SHA256

    f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a

  • SHA512

    dc0f8d8f5729c2b5cd2860a60a89b016258dcddf4c04e3fda3b63f67ca5a318cec5554112f9bac879bba347a174e1de45c3348ecec3a4bf81249252946a7de6e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    esut96092

Targets

    • Target

      QXVa6NvH82Yaiva.exe

    • Size

      682KB

    • MD5

      5b0f4ae46d79b6e8016b010d2d823e27

    • SHA1

      180c8936879c2da34329042ab56fb628d9f4766a

    • SHA256

      09be1d1130ddcf7aa7d321a4c70110c98a344812c818ed0cacfcbab916338034

    • SHA512

      b37dbd01043a184ba403c50fa7fe46d5b5a724f13d931a96e6dfb711e732b378807beadb31e42fcb3855cae17bddd6f1f94b6fa1023241aa99d2ad59feafc992

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks