General

  • Target

    672efe599206140279ea2cccb9e646a5d031eaaf095d2ca7e2c1967fb0611ed7

  • Size

    538KB

  • Sample

    220524-1gxl9scgem

  • MD5

    f8b29834f577fa100797a3ef71c093f6

  • SHA1

    9d0df3db593b3085e22309b090b25c3c7989b4eb

  • SHA256

    672efe599206140279ea2cccb9e646a5d031eaaf095d2ca7e2c1967fb0611ed7

  • SHA512

    50ded41d0bc711bebe02fb8bbb89e3d64de91b136c8eb5addc13e7d35793fd8b9efe51a47d492fcfea698c99c9ada2202200610fbb4ceeb745d0303a3cd957eb

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mosaiclayouts.com
  • Port:
    587
  • Username:
    sales@mosaiclayouts.com
  • Password:
    UY$W4+]^+9;)7CF5

Targets

    • Target

      BL & Shipping Document PPTX.exe

    • Size

      477KB

    • MD5

      c243cc720d1eda1c6a13baee37b4c1d1

    • SHA1

      946a34575eb88801da37b1e6c46a9b6afc694182

    • SHA256

      fe8b7dfe8bc6cf9d0bf54942b5bdb15a1f24cc9fd7b2f680413ec97885ec1118

    • SHA512

      f72fdbcb27fa02127b61d80ee7e6556b37090bf15b1d14538ce4ab5dbc452f3d7585e0e1642a7875b17a1efb949e9d21e05829f62776fe77d0a42e568e1dfb67

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks