General

  • Target

    9028454677e948b5b3520d814e100d457231757b4fbbab2daadafa88bd03edcb

  • Size

    399KB

  • Sample

    220521-ae8zeaabd6

  • MD5

    cb0f6e1c2b1f8b81049acd92af00e3d9

  • SHA1

    d8ffc1019d8c2a3b55dc7973ef6a0ff88265e187

  • SHA256

    9028454677e948b5b3520d814e100d457231757b4fbbab2daadafa88bd03edcb

  • SHA512

    8ddb396016768a695e1cc63667596a4fe135e230457314a3950353f1825018f27629b32f7a2bee6d79d43b355141146e334f3351f9283c1522a7f8a6fada7fc8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    IFEOMA@@@@@

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    IFEOMA@@@@@

Targets

    • Target

      DOvdBmt0rIloEot.exe

    • Size

      441KB

    • MD5

      198fe83b467a4fbd36f77e25977075da

    • SHA1

      5f0df447b6824adc10bb5d08ccba8ce4c74e474d

    • SHA256

      7cf01aa842603da3c78a83e2ca7b456a6116c3a0f21bccc699bb2fb24a652d18

    • SHA512

      4a7b0626e3f149580d6c4866ca9f0d09870a99c68d6c0db927b92bd9bcd354b9fa8632678f70ae0422d40c7de70aa416f237e240055d84eaac5b8188cdbabf57

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks