General

  • Target

    3d9ff74d7e54cba0ee08a46cb1e7d7f624398ba949aae2a0e35dd23892bf562d

  • Size

    404KB

  • Sample

    220521-n9d96saafk

  • MD5

    7737856fd67a9b5c796fed1f42b651b3

  • SHA1

    17f40840376dc513bd7aae5424c737885b11264a

  • SHA256

    3d9ff74d7e54cba0ee08a46cb1e7d7f624398ba949aae2a0e35dd23892bf562d

  • SHA512

    0b509181c917c67f0b47c634f99d149b3a463fa61d4ad8af8248ae354dd519fb5dd548bd50904043608e82cf0af1e2efe4b3558872c699378663628d659e985f

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    mrcvr@tronois.com
  • Password:
    mmm777

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    mrcvr@tronois.com
  • Password:
    mmm777

Targets

    • Target

      DHL.exe

    • Size

      475KB

    • MD5

      16135ed5d62f8ca7f63ba5a681e9efa7

    • SHA1

      7a963aac589f84f446bef0b1758879065e4d3780

    • SHA256

      c0c639e1f923a3dd8e88f2ee1b6a397db9f62c5688f6e04181f43f8b950e8914

    • SHA512

      d84c7f051d2b696a8b7b83db87c6786375460f4f4463587ba0534f28db54a6cb378a2162c745f45a46caf4a1176028933b642ee628199e119e5e4844fe9c212a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks