General

  • Target

    476723b94746037cf4b29a03167fe89d15a65ac090cc04ca4a0643ff47d31023

  • Size

    459KB

  • Sample

    220521-aw9x2aahe7

  • MD5

    35d42c33cee37e9339170fcfc59fe2b9

  • SHA1

    903aa4f0bd92764baaf5f836c744ff1007619d6e

  • SHA256

    476723b94746037cf4b29a03167fe89d15a65ac090cc04ca4a0643ff47d31023

  • SHA512

    cddf8e2e30567076696826558d5489ea31e12f89b07f2afa8cf295cd21708ad8dbad984234e5cf2d6bcb7e63b605aeb04bde41fa88b82015066d9912453e4d92

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.malkocbebe.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Malkoc2020*

Targets

    • Target

      PO10007986.exe

    • Size

      714KB

    • MD5

      e8975481528a738ad90dfb17f18ab9d6

    • SHA1

      886051a6c3c292f1fcb0dc37496eab10ed57c865

    • SHA256

      77a1ede94526537eaafb97d3988163df0f3cd6887d762faa2db61e49bdeefc02

    • SHA512

      4157640c3749bf81ede2e96437af10d43e5d9b79ab1b838fe170ebcd185f1dcf2c23b3523834f0f55e5dda752f70d246d445e15ed9f4bb2f969046f1c26364ef

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks