General

  • Target

    SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERQ.MTB.11269.29978

  • Size

    698KB

  • Sample

    220504-je8s3sfhdn

  • MD5

    b78eed700665bf868771e371d2622000

  • SHA1

    48daa093155e9eaa563f6eb537a57f940f2aa6c6

  • SHA256

    9eeac4773d7f0e7f4303baed25c04f0b138e55f9fa7e7c718e3e6599a2e41513

  • SHA512

    c8a943811ba8173a49941a85803a5dc0084c4eab90d7a79f3e4115992ffe6f115237b0b56e85aaaf940f6d2e6a1b1fac31541f32554c799bd259bcb3e5873e58

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5187728823:AAGLMGn_JlHiLgjLPDeSA29u69fic0Upi8Y/sendDocument

Targets

    • Target

      SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERQ.MTB.11269.29978

    • Size

      698KB

    • MD5

      b78eed700665bf868771e371d2622000

    • SHA1

      48daa093155e9eaa563f6eb537a57f940f2aa6c6

    • SHA256

      9eeac4773d7f0e7f4303baed25c04f0b138e55f9fa7e7c718e3e6599a2e41513

    • SHA512

      c8a943811ba8173a49941a85803a5dc0084c4eab90d7a79f3e4115992ffe6f115237b0b56e85aaaf940f6d2e6a1b1fac31541f32554c799bd259bcb3e5873e58

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks