General

  • Target

    6d94587cde5cdb5f21283032c6e40a030c67fa556016584f8f075918c4ea4bc3

  • Size

    393KB

  • Sample

    231207-sx99ascg44

  • MD5

    d1bcd3ba631379c06581efcb1b56b5b1

  • SHA1

    0d75ac87e7328f5da4e221d5ea94ca6a5b9b8cdd

  • SHA256

    6d94587cde5cdb5f21283032c6e40a030c67fa556016584f8f075918c4ea4bc3

  • SHA512

    b4f2b66a3734e28841f73c83165bc85e567b52537ecf775217a05acb47d747c1a71120c683a7c4c077574812b243e67c42df06dcc29066d7648b152a0c6f71ef

  • SSDEEP

    12288:zLdD+8HDMZrVgvuUDFBBqugx8Xtp12VlHXfE9p:HdYovu8/ZL16a9p

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.activegroup.com.sg
  • Port:
    587
  • Username:
    staffing@activegroup.com.sg
  • Password:
    active7244

Targets

    • Target

      Payment Copy Pdf.exe

    • Size

      420KB

    • MD5

      79111a86d3b49cfd6064e27f5f2e6d83

    • SHA1

      f61bc3418e9ca92b02f21c66af2ff94bede59f7e

    • SHA256

      b9381cede9bdb49cd74a7ee1d5fa91a3b04bb99f4d3c8be2239f5bc268df8cfe

    • SHA512

      17e04bd8663fbf88c3ae7125ff9bdca8f2ac649bf512fa0c2f0352ba57cfd3a794c58288c3977d2c1611ae97eb34ad1046a78211d1babebb911198caac475a0b

    • SSDEEP

      6144:T8LxB4D06oRE8vLVI3FPs+DoRRf+Dv4QR/VOxahjMc8Gh/DGIIrlqnh+NG1kXdfu:HJZG+3FPfCRf+JsM1MWh/DFulHPfE9V

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks