General

  • Target

    a4ebe2e53ca2a48c4d01c7685cece4ce62b810246213c28f0794d7af0820b330

  • Size

    653KB

  • Sample

    220521-nehn4sgffq

  • MD5

    787939f5b13c0eb8524efe8a0d9c0c36

  • SHA1

    f274622d13ad72fbece6e35e150babbb752e99ed

  • SHA256

    a4ebe2e53ca2a48c4d01c7685cece4ce62b810246213c28f0794d7af0820b330

  • SHA512

    b23a0ee20eb00b0db06d3cf884e2f3678103383dadb567fc76b964e48aa40537de7e74358651910a6d93f92a33b8f91666e7c80d278823a79643172136ec9820

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.qatarpharmas.org
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    v~t-0~GGykudc@r&u*

Targets

    • Target

      a4ebe2e53ca2a48c4d01c7685cece4ce62b810246213c28f0794d7af0820b330

    • Size

      653KB

    • MD5

      787939f5b13c0eb8524efe8a0d9c0c36

    • SHA1

      f274622d13ad72fbece6e35e150babbb752e99ed

    • SHA256

      a4ebe2e53ca2a48c4d01c7685cece4ce62b810246213c28f0794d7af0820b330

    • SHA512

      b23a0ee20eb00b0db06d3cf884e2f3678103383dadb567fc76b964e48aa40537de7e74358651910a6d93f92a33b8f91666e7c80d278823a79643172136ec9820

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks