General

  • Target

    e2926fe08147ddefdf1eba31c56e8a08ae51778d99c302ced3b339edcf64e6e4

  • Size

    559KB

  • Sample

    220520-3na3yshbg5

  • MD5

    1ab59e5936f1ffb1fac51cac987efa93

  • SHA1

    841570fd7d6b6747828c1ba7e96d37430ca8d808

  • SHA256

    e2926fe08147ddefdf1eba31c56e8a08ae51778d99c302ced3b339edcf64e6e4

  • SHA512

    5ac4d558531a96d2ecdf8c59d4e8aa9853720142ddf837f9e7b992b87cc434ef30135bf26e74ae5e3594fe1ec12900c7b62f2f7eb6dfa682658d7da8ce07db34

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.clrakmheu.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    GDXAP$m2

Targets

    • Target

      NEW RFQ..exe

    • Size

      741KB

    • MD5

      079e6eb484455032acf3b2fd4c11299d

    • SHA1

      7451b2517d7373f7a81c0876fd66bce472321f79

    • SHA256

      b681ce953d7122c634acb0c68e4885a7e6d182acfbc43f886160b2796f452d99

    • SHA512

      d55f2e77a5288720d0a7d3ddd0a523cd9e6b9fe4855c19eb909f101349bba799e2207ff5ed01c44453cdd35e31e553092ae5081e05f8a0f8db4f5a490581e1b3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks