General

  • Target

    13949e64a5f8277e4614294a45528a4d43f22d03829f3c477533e35d93c0df59

  • Size

    504KB

  • Sample

    220521-pc65csacdk

  • MD5

    945856cf053bb6dc09c0f83674d41287

  • SHA1

    5b5b4498f1864856298ca9f13a0e0b90ba2b0f71

  • SHA256

    13949e64a5f8277e4614294a45528a4d43f22d03829f3c477533e35d93c0df59

  • SHA512

    bad61d01b23f3aa8a79b88a4b5d8b8c2a33db80566a0d3f7ce3ce41e60e818e72492548aebef5a50b60c96248e5c8af0ab4d335ef40179d4858545e5ec43d0b8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    dtoydreamer@yandex.com
  • Password:
    internationallove123

Targets

    • Target

      Scan Document 06311_PNG.exe

    • Size

      869KB

    • MD5

      26ca848025d9021542081e7983e577b9

    • SHA1

      2db08626337ac47a8c024bd1ec0f9da603c762d0

    • SHA256

      718612fc81bf6ba414792fdd4167f7571295b147c14377130931f4a096fac2f2

    • SHA512

      22d81689a3ee8cba9c99ad9170ed558affd3a3bff9f4dc6ca52c395f85a96af94290e43df5d865762e8ba71e53cffbc420b7586e05d1aff88ba34a362a7a7cef

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks