General

  • Target

    fbdce63624e5094c32f20b73c450959884cf7d7c5f3c85bc5fe205de35725f85

  • Size

    440KB

  • Sample

    220521-mxqxrscfc2

  • MD5

    96ea50ca2ef577ebca472b5ed4783ca5

  • SHA1

    3db2bc8f3c0410bf937643e338a4c3fe77321674

  • SHA256

    fbdce63624e5094c32f20b73c450959884cf7d7c5f3c85bc5fe205de35725f85

  • SHA512

    53096c0dfbe8a1f1c22d33403209d78e7d6385e7ffed2cde698c7176ec152a8705550f1ac34300a61149d0b81fe03f4fecc44a22b207e43004d6cdec42602349

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.bnb-spa.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    tPo!47:glt$E

Targets

    • Target

      Order confirmation.exe

    • Size

      691KB

    • MD5

      26f443f71c6ad850b704d85210309ecb

    • SHA1

      a90d70316a39305cbd5ccefbe24e012334e3e086

    • SHA256

      83d8b3913153282a251fc2f7bf74f701e02969441341297823957e5d35a5c3b0

    • SHA512

      f942bdaf859d0cfbae49b56354146c39d9f2b52bd5ee4b189ed3a49bd62695692a6385f6b488a6bfb5ee3fd58544219f1c8442acbc0190a3662a010e54c1ec60

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops startup file

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks