General

  • Target

    ec06302a54b3130a87c2d018b89c422e54f2b9c3957ea3d5b8dcebcc4f32e5d1

  • Size

    774KB

  • Sample

    240328-bfjlkscd3t

  • MD5

    5f1ddff39c01f97878dc4d7d49d1f71d

  • SHA1

    5288bcdbd5eb69394177eb7fdead46b60d282838

  • SHA256

    ec06302a54b3130a87c2d018b89c422e54f2b9c3957ea3d5b8dcebcc4f32e5d1

  • SHA512

    a32759cefdeb87e6eca2b1823486b12c452eaf2dd1ff85eb6cd326d190fc9a9806b6398208198033cb04f7c4c52ff1090b29a4ddd491ec4a597ae49efbdd9024

  • SSDEEP

    12288:yDspRsBv1+jMsbSQIP7Ew1XaXBaBHY79prx4B3PPehHO5aIxST0V:1pRsCjpbfIP72EcFy3335bxS

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kabeercommodities.com
  • Port:
    587
  • Username:
    export@kabeercommodities.com
  • Password:
    w{A6H.o&sz%g
  • Email To:
    successbright053@gmail.com

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kabeercommodities.com
  • Port:
    587
  • Username:
    export@kabeercommodities.com
  • Password:
    w{A6H.o&sz%g

Targets

    • Target

      ec06302a54b3130a87c2d018b89c422e54f2b9c3957ea3d5b8dcebcc4f32e5d1

    • Size

      774KB

    • MD5

      5f1ddff39c01f97878dc4d7d49d1f71d

    • SHA1

      5288bcdbd5eb69394177eb7fdead46b60d282838

    • SHA256

      ec06302a54b3130a87c2d018b89c422e54f2b9c3957ea3d5b8dcebcc4f32e5d1

    • SHA512

      a32759cefdeb87e6eca2b1823486b12c452eaf2dd1ff85eb6cd326d190fc9a9806b6398208198033cb04f7c4c52ff1090b29a4ddd491ec4a597ae49efbdd9024

    • SSDEEP

      12288:yDspRsBv1+jMsbSQIP7Ew1XaXBaBHY79prx4B3PPehHO5aIxST0V:1pRsCjpbfIP72EcFy3335bxS

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

4
T1005

Tasks