General

  • Target

    fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48

  • Size

    537KB

  • Sample

    220625-lvnh7ahfd4

  • MD5

    03e287ec10c07c45c359c024d423debc

  • SHA1

    3c13bb9709fa850d6eb76a150f19840043935a39

  • SHA256

    fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48

  • SHA512

    e57c3ce93756460287465fc05b61af4cf5b6d820f344ed15b01dba0322a63bfaee6b72125367332d95cec77bb570d9b18ca4d70b5146e8db492b4a29d7416a5f

Malware Config

Targets

    • Target

      fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48

    • Size

      537KB

    • MD5

      03e287ec10c07c45c359c024d423debc

    • SHA1

      3c13bb9709fa850d6eb76a150f19840043935a39

    • SHA256

      fa6b635dbeb54520183858face68bfb2056b9d6ca7f0f971b352f1ad90d80a48

    • SHA512

      e57c3ce93756460287465fc05b61af4cf5b6d820f344ed15b01dba0322a63bfaee6b72125367332d95cec77bb570d9b18ca4d70b5146e8db492b4a29d7416a5f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks