General

  • Target

    SOHD5510420.Scr

  • Size

    880KB

  • Sample

    221207-h5vtgahh7v

  • MD5

    a968d6ad57890d14a90d141bdf701a6f

  • SHA1

    850a3b7eb6d6251385c22dd9ddf1103714ae63c7

  • SHA256

    a32619cd26fbb97072657ec6a481d4f4fd6c51b72ea5ea0837006d9a8dd24800

  • SHA512

    8cf15a33bb90f5e62e21914edb533048a7605022cbbcd7284e583d5b9230402a6dbd194668216beafc5f651265fb964513593ccc133450e0b5fb46972ce140af

  • SSDEEP

    12288:cFoQgKZ/nXt7virmWhlGLaQYIM9plrYowdeGy31hxaiNQZQ8mPSH9sz25mIGIIKP:cENE/yFhsKwH9sz28IGIIK8DErr

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    work-toolz.click
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    3HLkst~=QzD3

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    work-toolz.click
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    3HLkst~=QzD3

Targets

    • Target

      SOHD5510420.Scr

    • Size

      880KB

    • MD5

      a968d6ad57890d14a90d141bdf701a6f

    • SHA1

      850a3b7eb6d6251385c22dd9ddf1103714ae63c7

    • SHA256

      a32619cd26fbb97072657ec6a481d4f4fd6c51b72ea5ea0837006d9a8dd24800

    • SHA512

      8cf15a33bb90f5e62e21914edb533048a7605022cbbcd7284e583d5b9230402a6dbd194668216beafc5f651265fb964513593ccc133450e0b5fb46972ce140af

    • SSDEEP

      12288:cFoQgKZ/nXt7virmWhlGLaQYIM9plrYowdeGy31hxaiNQZQ8mPSH9sz25mIGIIKP:cENE/yFhsKwH9sz28IGIIK8DErr

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks