General

  • Target

    5ce8c4d2e12543d6c237e1f98c76c6daff01b3e477c40e5abeea39afb7327da0

  • Size

    1.6MB

  • Sample

    220521-arwjvadfcl

  • MD5

    080e4d79d6178bdc12ab39a8fac1a75f

  • SHA1

    741102a6813d1561292a8169e1f0dad030db2fc0

  • SHA256

    5ce8c4d2e12543d6c237e1f98c76c6daff01b3e477c40e5abeea39afb7327da0

  • SHA512

    0387cc9e0e1c55a5ee332f4344c6df3cc3be0a7cc0e9e659567f9c74425043837ecfc44a2e3e655f8d7405ddf00eed644afc93a729e52f9dd467950978dd0cc4

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.northwestpowdercoating.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    C^0z.^LxykTW

Targets

    • Target

      TRANSFER.SCR

    • Size

      1.1MB

    • MD5

      b3af901e962e7693a2be0ffd2c360538

    • SHA1

      6669cd006c13bbf3927063ffe5701bad1b698c3f

    • SHA256

      392faa37063ee6a619a3091d1d7a27b8c0d86d35a7f1594720822f8a94ce9d1b

    • SHA512

      6976f08cb58d80cb8f819aa105fc2af0f00059d839e8fa9348a8ffd95ccac6a42ad298f500e0a5aafe7c10605080d67ffb260a678d81c0416095461d1d5f5b6f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks