General

  • Target

    3d1f644e0be5bf18f97f1d8094c92fec74c1e55230eb11928d9a555ef28b77b6

  • Size

    550KB

  • Sample

    220521-n9hycsaafn

  • MD5

    974ce1759a3872e956c1f5e190671de2

  • SHA1

    96344e617170e665318eb1edfc0c94eca49ea52a

  • SHA256

    3d1f644e0be5bf18f97f1d8094c92fec74c1e55230eb11928d9a555ef28b77b6

  • SHA512

    1d3d4f721d70b33b13501ce90812d65a0c87c39d3c981fd9220efe7cb30a6cba0a4b080b3c24e18bc063bb508ac8373cfca6357e8d0091666c4bff30af4c1f41

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    banks.logs@yandex.com
  • Password:
    Swagger22

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    banks.logs@yandex.com
  • Password:
    Swagger22

Targets

    • Target

      Ref ____ No. 12082020 ___ Scan.exe

    • Size

      688KB

    • MD5

      bb22c8af05bf472b9a2574e8b82d5074

    • SHA1

      0f8ab7991bc71001352f13f5ad2b8d9bdbf1df7c

    • SHA256

      9f45c86fbb9fb265250eb08929d8c8cff306fe1715bcbb2e6fe5008f38903f5e

    • SHA512

      841990552274176f36b54b39afce11ea6ed9a4bdec900f47d673d517860f9ec1442d294361e72963a9aeeb64e45d60e9ecd958132b3709f026362f49999fa7f0

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks