General

  • Target

    SOA.exe

  • Size

    597KB

  • Sample

    230623-hxmswsda22

  • MD5

    f1704d78a43bd138305e179bfadc3665

  • SHA1

    580c3e407bdcd605bbd9aa8b028e38d646cd5f88

  • SHA256

    9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd

  • SHA512

    b4d7f4e47082c3a333875b5baa5cfce739a4da48b4b36c19edb2564a2d84a1412ec432cf24e39af45c2cb97af739d9524706b05573721d689b891174f7086b61

  • SSDEEP

    12288:ok54/mNUAviJiQ8pVcGrylGbdOrtv0vrKJTCwXRnPfQ1:ok54/QUAiY/ZylGJOBS2CoPY1

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SOA.exe

    • Size

      597KB

    • MD5

      f1704d78a43bd138305e179bfadc3665

    • SHA1

      580c3e407bdcd605bbd9aa8b028e38d646cd5f88

    • SHA256

      9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd

    • SHA512

      b4d7f4e47082c3a333875b5baa5cfce739a4da48b4b36c19edb2564a2d84a1412ec432cf24e39af45c2cb97af739d9524706b05573721d689b891174f7086b61

    • SSDEEP

      12288:ok54/mNUAviJiQ8pVcGrylGbdOrtv0vrKJTCwXRnPfQ1:ok54/QUAiY/ZylGJOBS2CoPY1

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks