General

  • Target

    1876ea4e87fed1bca0296aa51195ebbd3ce8f334f6557fdc59449db6c48d1581

  • Size

    279KB

  • Sample

    220521-bb7gvaegap

  • MD5

    e92e8779bbd65629b3ce1df74c591b12

  • SHA1

    f9f56a1359a928546189c2703b45bdc8864f215d

  • SHA256

    1876ea4e87fed1bca0296aa51195ebbd3ce8f334f6557fdc59449db6c48d1581

  • SHA512

    41d8e11a99b1539ca02f4a2a618e0ecc026195b70b78b434b3d913ad8a2e8618d6ec9521eb55417f45ae06e629bfb7d9216dfbf87e50a00349af800f241a04db

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ginternational1.

Targets

    • Target

      Remitttance jpg.scr

    • Size

      324KB

    • MD5

      dce5536f0ec74014e25f5253447d4e98

    • SHA1

      29209f0f85dcdd71ef3453caf3b208c1a2120776

    • SHA256

      d93fb27172d9296a4067808a2dcc325bbed786666cc49646dfd0684ad9a92beb

    • SHA512

      1acf8e60b674ed698dba884658ed82be16156f85b39fe1b1c18598e64b527ccfd3b529b2b22185d85d50e5efab380c08749e189b4a83476c7ea8e69a62b515a5

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks