General

  • Target

    ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc

  • Size

    424KB

  • Sample

    220521-nc9d2sdeb5

  • MD5

    999ca1102c1ea692e6f1e2040ba5e10b

  • SHA1

    c0d56ab40c2332bd14c55bd39d36d5346146733f

  • SHA256

    ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc

  • SHA512

    8fb462ecdc576ebd8c2cc22555f5af60ad6a256bca1c2ae0be34d81b2bb7bde3e3daba88773649fe392d4db537170564ac0e396261f23bfda1f2cecfabe02e0d

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.tolipgoldenplaza.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Golden@#$2019

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.tolipgoldenplaza.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Golden@#$2019

Targets

    • Target

      1332000.exe

    • Size

      490KB

    • MD5

      997fbde85639834481305ad52fe98405

    • SHA1

      418a61aa0b2e94a3fea886de1c5b195bc671c59c

    • SHA256

      a044953a724f642c119477d17d23e389c44068773739e51d1b996cd6b2f51f4f

    • SHA512

      5385d3830be67d0b87c4eef78b96d0ffa0dc8dc7bb5631b2b5059671f09631e03e9b8ba60f012b04e93411f68c960ac637c51fcf55ed810c27e9097d0828f0d6

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks