General

  • Target

    yu6NsfbmMAuL173.exe

  • Size

    575KB

  • Sample

    210222-qsc6wczvks

  • MD5

    a61eb173cdeb421cabc0d95adb600417

  • SHA1

    a4ca2077b7195c6e9cbcfe932275840b7a03e016

  • SHA256

    a5117eb684d040eb8b71762d4bf70e8e1aa0bb3b228246f5141a3beb4cdf0463

  • SHA512

    2863d9aac1532310c7ad17465c836124380a3ff29bf5af27b21f165c271462152541f2ca66a02f86b8a4cbc65c73499d4850023c740fbc8b542ad4462451b4a3

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.shahdowlla-fashions.com
  • Port:
    587
  • Username:
    arif@shahdowlla-fashions.com
  • Password:
    PAss@2018

Targets

    • Target

      yu6NsfbmMAuL173.exe

    • Size

      575KB

    • MD5

      a61eb173cdeb421cabc0d95adb600417

    • SHA1

      a4ca2077b7195c6e9cbcfe932275840b7a03e016

    • SHA256

      a5117eb684d040eb8b71762d4bf70e8e1aa0bb3b228246f5141a3beb4cdf0463

    • SHA512

      2863d9aac1532310c7ad17465c836124380a3ff29bf5af27b21f165c271462152541f2ca66a02f86b8a4cbc65c73499d4850023c740fbc8b542ad4462451b4a3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

3
T1005

Tasks