General

  • Target

    4678536d2372a8c2227ce010647456497b0bd9251008d4b4a0ce85914b782fb3

  • Size

    370KB

  • Sample

    220521-pl343aagcm

  • MD5

    15937961a5c8cddd39bc0aec975cd72b

  • SHA1

    b177a85fc0f3df1a8527fbcd98aaf8c28a6cd3c2

  • SHA256

    4678536d2372a8c2227ce010647456497b0bd9251008d4b4a0ce85914b782fb3

  • SHA512

    02fa18cfcad7f6a77a09513a2180c3c4c82e686744afaf1d2b24740c002a466b5f6e0e0f25e366f15e400d7b443124ad1346a8f85dd041b54655dc8497ee5133

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    web2.changeip.com
  • Port:
    587
  • Username:
    remedy@chrismehat.com
  • Password:
    OGywVbROjkvK

Targets

    • Target

      po=593624.exe

    • Size

      410KB

    • MD5

      ba0ebf1fef1d06e21378af70a1e8babe

    • SHA1

      b0d07ccd59b84569841d2aa3a0529cedb7d7ecc4

    • SHA256

      744b624507df8e9bccf72af6cc834130ad75deb8c1beff8084cd101605c8eec1

    • SHA512

      ce49bc92c10916afbc9f7c8bc1d9c34184f674f62f03ac02b600c335aec5873c4dcaaa6dd275f539bafa088f8ae79dd197269c85bb7b59e8b3598c8c0ed5954a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks