General

  • Target

    PO_4500003061 signed copy.exe

  • Size

    880KB

  • Sample

    221207-h3s7vseh53

  • MD5

    9bd1c9256c64814f6c83e3a76f60c42c

  • SHA1

    b7867985ca8a61d942e82a021e27b9dbea5c0b42

  • SHA256

    59e009667dbb1344d0639b171763fe0d79b27e4419df4ee9829b7789197cc6e4

  • SHA512

    ec602de86a0eaf3472a2bade71d66b05e3fb833a14392baae9bf699a46aebbd8c2892cea2ecca9ec8b79d3a68a6f86c43bf267888bc83607fecd40bbf24fa102

  • SSDEEP

    24576:mvH2Mj6pEyFxCUVZHp24gBxIKH9zPlESv:mvWMu6yFVVxp24gBzRP+Sv

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.saudlunion.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    QkOo#D#4

Targets

    • Target

      PO_4500003061 signed copy.exe

    • Size

      880KB

    • MD5

      9bd1c9256c64814f6c83e3a76f60c42c

    • SHA1

      b7867985ca8a61d942e82a021e27b9dbea5c0b42

    • SHA256

      59e009667dbb1344d0639b171763fe0d79b27e4419df4ee9829b7789197cc6e4

    • SHA512

      ec602de86a0eaf3472a2bade71d66b05e3fb833a14392baae9bf699a46aebbd8c2892cea2ecca9ec8b79d3a68a6f86c43bf267888bc83607fecd40bbf24fa102

    • SSDEEP

      24576:mvH2Mj6pEyFxCUVZHp24gBxIKH9zPlESv:mvWMu6yFVVxp24gBzRP+Sv

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks