General

  • Target

    REMITTANCE COPY.zip

  • Size

    767KB

  • Sample

    221205-ry2g4scg91

  • MD5

    509c8e2d72bb96b00c1812f6b0b37a76

  • SHA1

    c266c93f008e1799af5d9f7902dba7bf758049e2

  • SHA256

    9baefe84948bb3043d255f7f7d583712d6cd36a2054f7471a55ac4f850a2d9fe

  • SHA512

    0a8066c9293ceeb9fc4d045e6c896c36923612baa09b3254b59a7034709e59a2fd70abd8ba0c83dc582f80b69f46563d14ffc474f2fd63ec78ca5f08f8b4a31c

  • SSDEEP

    12288:nF804U7a3iJm21Kvr81SEMFIifYKp3N7k9KR6WEMxy2THXV5NhsqBy5Y0r:nH4U7vJJ1MDH3Px/TFpsYy5Lr

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      REMITTANCE COPY.exe

    • Size

      1.0MB

    • MD5

      8bfedcd7d025aa96faa2334b5b85d959

    • SHA1

      a1b8959fb7b4d32a3adae8071f3a1bb581879737

    • SHA256

      fc41cb9d33a84a20e437091bf78e00938e4b5adb003f6c86370e975912d74dba

    • SHA512

      d40049e5e05ade2a73f3dd0fa31273aa4a060eb661ffbda983053d2642b574a14d46cba280f699a16d104a807921941e6ced71774e0eb36323671b7590415662

    • SSDEEP

      12288:ezlTteyx4xi85V4O4O5R2+nM87kzJNolKR6HkSwx7IkNu07k9md6WqmxyeTHXb5M:UCxRd2s/VlKcZw+mu0xjTrpq8y5dH

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks