General

  • Target

    9c1a4f96e16a5c94f069adb4ffb83d1960472f5ae494210ca0e50d4c4073dcfe

  • Size

    557KB

  • Sample

    220521-nen6wsgfgq

  • MD5

    2c55d9b325e2fba331c34269e5396f8d

  • SHA1

    56d6b3271ec288929e214f90cab75d268ed1548a

  • SHA256

    9c1a4f96e16a5c94f069adb4ffb83d1960472f5ae494210ca0e50d4c4073dcfe

  • SHA512

    c12c94d7e12761d8d161a4ab45c2ab9e85878024a16761dd1b47fd46d9a0a6ea439d394128396053eeebe1ad4a3afe134309339d5871688442e6c3d548a501b0

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ok2019

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ok2019

Targets

    • Target

      SWIFT.exe

    • Size

      724KB

    • MD5

      c3c773188f2a491bb677d1018789cb94

    • SHA1

      d6d5c21a7b4c7cf098bc74e9a0e77710aa403c3c

    • SHA256

      0b958e6c3826a5b6cbec4f827dba24652088d1c8a531ff85736e546fe61cee37

    • SHA512

      853ddb7b084757099dc2f370349277ad830bf17665d3933875d10917e5cdcae32876b4f96caa3c93972462766ee46c5df033568eaaceb0e534dd02bfef507cd3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks