General

  • Target

    eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca

  • Size

    522KB

  • Sample

    220521-ndqnbsded9

  • MD5

    5ff0931e7415967430c614f884442eb7

  • SHA1

    5f385724acf8918ff12de511051be6f923167de6

  • SHA256

    eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca

  • SHA512

    e8fe830c284ddc78826f17c9eff488a01f100afe675e63c15ccf053608b56c8355ca645e1d5c05a59d666d8136a845f847d8d5165b7e804e00726434cd820d73

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    secure231.servconfig.com
  • Port:
    587
  • Username:
    info@eltaef.com
  • Password:
    eltaefSH6548883

Targets

    • Target

      MV_NAVIOSRAYpdf.exe

    • Size

      634KB

    • MD5

      e80127d7e94474e0e5d135066872ea81

    • SHA1

      476f222ec504cfe5bd6753a4e842edfa4b057ab9

    • SHA256

      16b640035421f4d02280a93e7eb442c0a6e933b34eb56b7a65365b154cbe7dbe

    • SHA512

      7701883511820dd01ff663ae3f568945147a4acddb0e74d21eb725fbbf7345f5f072432e5385d78343fbf934604ff8d18f2122a9cde34bfab9b857f675f7bdf8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks