General

  • Target

    9c49e4175821cea22f5edf0fa73415b0ff0779f7312c4cf14c6d88ae952654e4

  • Size

    383KB

  • Sample

    220521-cxlb6sefc6

  • MD5

    338f7c04efb446b593f7823df4cb62bb

  • SHA1

    7b9ceef10eeb2e2f4caafb08650b2cda6fa8e8da

  • SHA256

    9c49e4175821cea22f5edf0fa73415b0ff0779f7312c4cf14c6d88ae952654e4

  • SHA512

    010278bdedfa9e778bbd00b00fc7e53d89d8abf6409d3f34aa338459b5b3a25740c63962113398e71b010e1133479d723312925e1b8e1ea7f165f44efa4148ed

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    T@nkTr@ns135@$^6^

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    T@nkTr@ns135@$^6^

Targets

    • Target

      image001.exe

    • Size

      421KB

    • MD5

      06bf42d97d201d12f72e8774eacd6f16

    • SHA1

      417e7b5aee87389d551b78a73f0bc50c673bed5b

    • SHA256

      c5a9b35e88c8854b9ded651caf716d6ecf5e30454859c4a664d2120145bccc67

    • SHA512

      e6f703acd943798413ff377369ee396f111d17aac31a7338e45c71576be64c2ca867701c18e80047cb2d31f963ebb71071778a1b08a123a18e1f0e4b4d47bd4f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks