General

  • Target

    abe82c04c652b78d48bd0ef9aed89d0f7dc4684f7c9be6120da223e3aa316cd3.zip

  • Size

    681KB

  • Sample

    240427-bywnvshb7s

  • MD5

    5d8cc59875c67f299967a273d4fcf73b

  • SHA1

    9187d78fd551439890ce657e60dcf4d4bd22bf37

  • SHA256

    abe82c04c652b78d48bd0ef9aed89d0f7dc4684f7c9be6120da223e3aa316cd3

  • SHA512

    12269b26cdb1b2c1ae032587374f597e77266e0dfb8a535cd7411b542ee447e83314230d929f812dfdb8b36bc8e009ec300ac7b3ec37e97d2955fdb9c7fe7794

  • SSDEEP

    12288:7YRkFo9XGHz3Mo4w7i9NYDz2Rnrtg6De/kqg6x/Pe496yZHK:By9c4Mi9WeRrSsqv55K

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.clslk.com
  • Port:
    587
  • Username:
    gm@clslk.com
  • Password:
    NUZRATHinam1978
  • Email To:
    devendra@syncro-group.xyz

Targets

    • Target

      DHL - OVERDUE ACCOUNT NOTICE - 1301669350.exe

    • Size

      861KB

    • MD5

      840cbf490ce0600e1057f72949a37c73

    • SHA1

      151c7c81a8f1e9dd889eef12e8c4ca6749495dac

    • SHA256

      b09a0b160629c46cd40123518cf4beed875c630f8836e2fea5d894c43fd58093

    • SHA512

      922e31024ad6994330a528289d3ec3a9584e78b21bc32d8ee5419bc3793911fc4c092b96df0c3c55fe562f6fc761e1d60c8ac229e6c23bf8ab64e2d180c3b3f9

    • SSDEEP

      12288:0YIPXjD9Mo4ALYp92DzclnPtgmDHTtI24666LZwzcu+UEkwE6eeE2:0YIPiEYpQUlPvI251uAuhF5eB

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks