General

  • Target

    b5db18f947fa13c4ed6c8434217ab0eb3896d388f2c90f1055cf77816bbb8305

  • Size

    390KB

  • Sample

    220521-n18seshfbj

  • MD5

    0e5244a9aec63e15a392c2cb346e0cc0

  • SHA1

    9d15f0e4eba4272b65ec7dd74a224c34ceb65bae

  • SHA256

    b5db18f947fa13c4ed6c8434217ab0eb3896d388f2c90f1055cf77816bbb8305

  • SHA512

    ca02b6c33980963eee24e3229be1831e89e0133ece6d9f17c95452a749c73aab17983773df3e87cd9e8d6201b0de87b8a9a9724f66e8572c0145b754137961b2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.goa-usa.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    SQeUpB%7

Targets

    • Target

      order product list.exe

    • Size

      574KB

    • MD5

      b7d4ecf747a1e5a4a04179f775c50abb

    • SHA1

      d0e4ebcf70a56c9c57f96e94f54aae9749a4ac3d

    • SHA256

      fc6d76b83d4292945015a7a7b9440f510732a070d9d1cefd26fc3d46591cca9f

    • SHA512

      5ae36c69ef09d9ae7677094ad7928031b6cf484bbde606a9e74fd10d0e6f0c3cbd45c7f16e5b93a1a1f4dedda82ce1a0ed3d61e6482e01617935ef96a3a53f15

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks