General

  • Target

    e8138321c99700234e5e79d81c480c6798bf3d6df2dad375fbd8beb96d16635a

  • Size

    422KB

  • Sample

    220520-3mgt4scafq

  • MD5

    73f36357a01664d146325d1ede293ea2

  • SHA1

    b3dcb1409d75c14ab3e24da99784d2c893c8f5cf

  • SHA256

    e8138321c99700234e5e79d81c480c6798bf3d6df2dad375fbd8beb96d16635a

  • SHA512

    68fdc681cf844faeee4205d0320a855d5b25004ac949d61b25737da143ddcb364fc216cc21f28a1237f52de3757fb7333d5c3f73e02ea70732c24417240650ad

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mrshelp23409@!!#

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mrshelp23409@!!#

Targets

    • Target

      POewWa3MHHx83.exe

    • Size

      646KB

    • MD5

      8e819fb39a348253d262fbb8304efb41

    • SHA1

      9b84fd1eb519c43c80f840b784c5c092721958b9

    • SHA256

      434697235faf9c70e317884f73881d5a2c0d4ea353641e65a95bb8a3c9fadce5

    • SHA512

      ca89a91100b9f140a795cb65dfb6cabadc71938e69cde2a1e72229b34b50a485b57e44482bf26dfbaa65870d8ae021babf305717cd0cbc9b48ba71bc6576504e

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks