General

  • Target

    9aba5440c61738a9c4fd5987c530f7d65d4091ece834f741cdd103ebb50867f7

  • Size

    417KB

  • Sample

    220521-ng6tqaghbq

  • MD5

    ceecaed72ead9ebcdb8b0026334bbb6d

  • SHA1

    b6430ed80cb83598c425750f28e059ab1265edbc

  • SHA256

    9aba5440c61738a9c4fd5987c530f7d65d4091ece834f741cdd103ebb50867f7

  • SHA512

    084d3221f7434b963a2cab2a2f5982428d291a3e062dcdc2f6e4e723123827a2960284dceb499acd95dda35be9af17b961d92f331b65bd03a20bd979832b9e2c

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    info.ledscreenservice@yandex.ru
  • Password:
    OGOM12345

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    info.ledscreenservice@yandex.ru
  • Password:
    OGOM12345

Targets

    • Target

      Order Inquiry -CZ-130520.exe

    • Size

      468KB

    • MD5

      96a4f8cd9d91fc3525341d47e260b12b

    • SHA1

      ea9304a0eb3a0ad3828a8321d1af64f87aaf76b0

    • SHA256

      1529cc99d5896fcefea1802d4633d78f86e3184add5d7e451ea4f437bd451b17

    • SHA512

      1db43f635d06ea26dc3ca86e0fce2e55cc21ee8aae24cb9d07e0c3ddc26fe1987b6892240659a59f38ba2a1c2ecb3754c17bd2c201544450e12fba9a112ae9b7

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks