General

  • Target

    SOMGAZ PO NO6200125011.exe

  • Size

    733KB

  • Sample

    240210-nevnnsdd38

  • MD5

    1128c941c31bf5c69a05b8ea81f01f43

  • SHA1

    1426e216a1ae8a787104162228ba223feb6940e3

  • SHA256

    ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397

  • SHA512

    7bdb8cf37a4d6dd5554bea5f96ae072fd3d72f8f7357bfa32d09c28a9f8bb193b98398deea2e79ee539b9c3c6fc806cae8b28a5223456c442d21025dd966e68e

  • SSDEEP

    12288:/qBVN+10VUZVz7NB8OhlGdVWelWIy4Y+:/qsBZVfwOhwdQxIy

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/

Targets

    • Target

      SOMGAZ PO NO6200125011.exe

    • Size

      733KB

    • MD5

      1128c941c31bf5c69a05b8ea81f01f43

    • SHA1

      1426e216a1ae8a787104162228ba223feb6940e3

    • SHA256

      ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397

    • SHA512

      7bdb8cf37a4d6dd5554bea5f96ae072fd3d72f8f7357bfa32d09c28a9f8bb193b98398deea2e79ee539b9c3c6fc806cae8b28a5223456c442d21025dd966e68e

    • SSDEEP

      12288:/qBVN+10VUZVz7NB8OhlGdVWelWIy4Y+:/qsBZVfwOhwdQxIy

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks