General

  • Target

    485885e7fb7acedf7725c4c06222e7863207f5d99167348febc9b7a182413858

  • Size

    415KB

  • Sample

    220521-awz3tsahd3

  • MD5

    22a0a36ceed1fc2165b7b0eaf99889f6

  • SHA1

    e41d32073ad3eaefbb7691557c8d0c677a428715

  • SHA256

    485885e7fb7acedf7725c4c06222e7863207f5d99167348febc9b7a182413858

  • SHA512

    eaba44c4e389a617a9869013a5f45d303b8aa87e27f62fd37f30f0f3a18105065bd7e6fa3b4a84947655fe53f0014b38f512744a95abcfe4351102ebf9d818da

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    secure231.servconfig.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    eltaefSH6548883

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    secure231.servconfig.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    eltaefSH6548883

Targets

    • Target

      MVHEILAN_INVpdf.exe

    • Size

      592KB

    • MD5

      d07b3844baa07c57e8ef119ea1c29e85

    • SHA1

      0601eafdf5b9550b940a1255a28af2c5b4447eca

    • SHA256

      a8602955f5fdfafa21aebee64feb294b68d8e7b85997992c560f769329e7043f

    • SHA512

      4ea35d4591b4e205b17336ece22e99e0a0b603c0c38984f41ed2a0f417d2886ebe8aad52b1554bb9707ba94f3aeab44f10fb631f4cda52c683954e80b973fa95

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks