General

  • Target

    18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4

  • Size

    364KB

  • Sample

    220521-bx2hqacfd8

  • MD5

    e5871025eed1e3d02b73fc5acbf2cf46

  • SHA1

    92d740db16d0cc0c4bbafbfaf858ddec31199199

  • SHA256

    18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4

  • SHA512

    51e0a7ac4143168b7ef6fa089572bb5973a9a34a08cea7bc39fd4022626d4edef5dfd6cf3452202061c4c1c0bfb7baa7a774cbaf4a28d414a444e7c3c6602175

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OneDay@time

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OneDay@time

Targets

    • Target

      PROFILE.exe

    • Size

      453KB

    • MD5

      0730a8b1cadc7b07bd0a7fbe57437939

    • SHA1

      424eea095b6b46cc0d3d6812b85230308b672ce7

    • SHA256

      ceb7dc735aad69ceaa69d7353b2364bbaf2ccd69176707bdc0d7c38f27e326b4

    • SHA512

      563f6e6e58938730f68af98b0fdc7e7f079ff85222a4db9270bbc5ddf2a4f6ae607fdd271048443b0d9c5a48ba5c53e0928d515437a10d715a7d7deef9b98bec

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks