General

  • Target

    HUHE34ED34U.exe

  • Size

    718KB

  • Sample

    240326-157gdagg51

  • MD5

    e0f4226c8a03a6033b1ea0075056ad9a

  • SHA1

    910d11dae17bdd87040236e5be2eac30abb04471

  • SHA256

    e91d389bcd7dbcd63860b1bbe09fbc006880616e113630acb2dff1d5a41efb6a

  • SHA512

    4374798b697ebd65ee84fe923d1acdc6a85aaa398bb798817abd55f8ee4e25a6a47a0ac9782e5595a13238b5161b37c669ad9544255bdb5eec76c6e35b2a1b17

  • SSDEEP

    12288:da5WzrnDaFW0bfPdbef4XqXwK9Wfz+XTKg2Uzy9HOotXHisN:3fnDaFW0bfPo4XqXw8A9h9nL

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.worlorderbillions.top
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    =;=yKWThEGx-

Targets

    • Target

      HUHE34ED34U.exe

    • Size

      718KB

    • MD5

      e0f4226c8a03a6033b1ea0075056ad9a

    • SHA1

      910d11dae17bdd87040236e5be2eac30abb04471

    • SHA256

      e91d389bcd7dbcd63860b1bbe09fbc006880616e113630acb2dff1d5a41efb6a

    • SHA512

      4374798b697ebd65ee84fe923d1acdc6a85aaa398bb798817abd55f8ee4e25a6a47a0ac9782e5595a13238b5161b37c669ad9544255bdb5eec76c6e35b2a1b17

    • SSDEEP

      12288:da5WzrnDaFW0bfPdbef4XqXwK9Wfz+XTKg2Uzy9HOotXHisN:3fnDaFW0bfPo4XqXw8A9h9nL

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks