General

  • Target

    326866f45d9012b4997faa5c2d6d7b21421db4d7d60ee050b46dee9515a3ac40

  • Size

    541KB

  • Sample

    220521-px6dkabdep

  • MD5

    3dfd77505e49ecd3dc24b11af95dd688

  • SHA1

    dc3bbbbb987ef4ae6087e57a98d9f693aba57695

  • SHA256

    326866f45d9012b4997faa5c2d6d7b21421db4d7d60ee050b46dee9515a3ac40

  • SHA512

    253507f38c9748687fb174a7d4d5c2644b96ce2d8a74f9104fde4aefe43cf0de61f1163002a019fd355825f3efc520f6ed0587f57cef52a7fdd9b3ae493895a6

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    server122.web-hosting.com
  • Port:
    587
  • Username:
    burna@cdperenco.com
  • Password:
    OJZg,yx3yFHQ

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    server122.web-hosting.com
  • Port:
    587
  • Username:
    burna@cdperenco.com
  • Password:
    OJZg,yx3yFHQ

Targets

    • Target

      Purchase Inquiry Datasheet Of Listed Items.exe

    • Size

      786KB

    • MD5

      de95d2e03aaff80b18b08e155642b266

    • SHA1

      be1450801821cdc916570479e618a67090b82102

    • SHA256

      a52c72aa195562b2f469e6dbc1e2e7534aec440d4674cedb788f3800286ecbbf

    • SHA512

      2fe944c2731b5e3103337dc571de08d78fd7c1c47d0dfc68cc996b3057d476ddbe72bff97bad6bd3c58deda53ba1257b319208f2de7e49677b477134d0794371

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks