General
- Target SecuriteInfo.com.BackDoor.AgentTeslaNET.12.6450.17799.exe
- Size 731KB
- Sample240810-rseq6atbmk
- SHA256 f493aa5876e8e14c98f57fc1506b8e310eeaea75e3899b64aa7dfdfe8ac6687e
Score
9/10
Malware Config
Targets
-
- Target SecuriteInfo.com.BackDoor.AgentTeslaNET.12.6450.17799.exe
- Size 731KB
- SHA256 f493aa5876e8e14c98f57fc1506b8e310eeaea75e3899b64aa7dfdfe8ac6687e
Score9/10Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2