General

  • Target

    d318c7afbf8a03285e0f3b504491b573b295d60e98a605ef4b9e1546e38a0764

  • Size

    499KB

  • Sample

    220520-3rk3bsccdn

  • MD5

    084974cd5b022df9b8f5a07d9d84cdc0

  • SHA1

    55b3b5a2ac915aa9930d5e11efcfbe36f72ec53b

  • SHA256

    d318c7afbf8a03285e0f3b504491b573b295d60e98a605ef4b9e1546e38a0764

  • SHA512

    ee75e3cb1a19aac07922a1ad08518ca4949dc612eeafd7d62c9034866944df8ab6b00c85ac3c134c786a60f90afff74375b9ebf5ad33150fe528f0207151e155

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.exgold-co.tk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    001commander

Targets

    • Target

      Payment Swift #INV0189733-pdf.exe

    • Size

      674KB

    • MD5

      041a15f94d91d76249e1f18726779af6

    • SHA1

      a142fb148f008e8492b9068d419692884ae0167d

    • SHA256

      b5092e8fd4d7a8b9649b376301ea125eb63d8a5a04360c87a8140200ff31c478

    • SHA512

      7181a863c493df25c1bd874653ddc4ceb9e4ed036b8059326564ba7f1ec6f36951cde910507f5761b0d5a3448c0140ce6c30cb7720b01cfc481e9c3d4d7801e8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks