General

  • Target

    WaybillDoc_1009893562_pdf.exe

  • Size

    790KB

  • Sample

    230328-e6xgxagh95

  • MD5

    5ea10085db645a0c943cae3e079c1365

  • SHA1

    39477e60fe3a1a0365e36e82988f61aa858b928e

  • SHA256

    743e9ab3afececaddd02c6402d7099f7e5c19f54799225f396c6808da207e78a

  • SHA512

    241a79d8e137de843c3f053723ac34bc19f6ac4c37060c97f8b9dabb9c75f764330472eae8536dc922179f111ea5070bddfcd98cb8a9047821fcb233b5fac976

  • SSDEEP

    24576:EcVZ9QGb2Zz4Ps43botB1bBqIwW3ZNC4Mj:33uOlopbQgpg

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.valtronics-ae.com
  • Port:
    587
  • Username:
    eby@valtronics-ae.com
  • Password:
    YTMIlIR0
  • Email To:
    eby@valtronics-ae.com

Targets

    • Target

      WaybillDoc_1009893562_pdf.exe

    • Size

      790KB

    • MD5

      5ea10085db645a0c943cae3e079c1365

    • SHA1

      39477e60fe3a1a0365e36e82988f61aa858b928e

    • SHA256

      743e9ab3afececaddd02c6402d7099f7e5c19f54799225f396c6808da207e78a

    • SHA512

      241a79d8e137de843c3f053723ac34bc19f6ac4c37060c97f8b9dabb9c75f764330472eae8536dc922179f111ea5070bddfcd98cb8a9047821fcb233b5fac976

    • SSDEEP

      24576:EcVZ9QGb2Zz4Ps43botB1bBqIwW3ZNC4Mj:33uOlopbQgpg

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks