General

  • Target

    46aeb4d26e0411fabd5b6dd0f5ad00f962170a989416a11efdedc9f4134e1aca

  • Size

    551KB

  • Sample

    220521-axehhsdhfm

  • MD5

    c29c9807e54f22e7370f9f4e4d08fdd8

  • SHA1

    04a7fb009b373db8a645d4dcc0508ed700a40c2d

  • SHA256

    46aeb4d26e0411fabd5b6dd0f5ad00f962170a989416a11efdedc9f4134e1aca

  • SHA512

    554a6aebf7f1d3ae8a6f8c008eef514e2228526ac49d8236cc0953c1366aaaff32fa2bc0ef5236c371c914ed848907c526b114ddf6d9b1ac52ba89903428c4bd

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OGOM123456

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OGOM123456

Targets

    • Target

      Inquiry Order KV200803.exe

    • Size

      712KB

    • MD5

      4d58a216c3bf2157d40121e9bb0e4c7b

    • SHA1

      5603a8e2b6ab301c47a711a10fe654c587e47676

    • SHA256

      5fca471621deeb28a2e5acaee925fdbaad78c20c9717ebc5b145a79393bd377e

    • SHA512

      a0fdc1f1b3eef4ec23797358ed7ff7560926e192434059f43e120eee3d11a78094cf50bff7e02f77616aaeaa8b8e378988c3131f02a5b8ca38067dc87c82a5a7

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks