{"id":2365,"date":"2021-05-21T09:41:30","date_gmt":"2021-05-21T07:41:30","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2365"},"modified":"2021-05-21T09:41:30","modified_gmt":"2021-05-21T07:41:30","slug":"agent-tesla-del-2021-05-20","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/cyber-security-news\/agent-tesla-del-2021-05-20\/","title":{"rendered":"Agent Tesla del 2021-05-20"},"content":{"rendered":"\n
\n
\n

Agent Tesla <\/h2>\n\n\n\n

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
The spyware is created using .Net software framework. It is aimed at stealing personal data and transmitting it back to the C2 server. The malware is able to access information from web browsers, email clients and FTP servers.
The malware comes equipped with multiple persistence mechanisms that help it avoid antivirus detection. As such, it can resume operation automatically after a system reboot. It is also able to turn off Windows processes to stay hidden. <\/p>\n<\/div>\n\n\n\n

\n

SilverTerrier <\/h2>\n\n\n\n

SilverTerrier<\/a> is a Nigerian threat group that has been seen active since 2014. SilverTerrier<\/a> mainly targets organizations in high technology, higher education, and manufacturing. <\/p>\n<\/div>\n<\/div>\n\n\n\n

\n\n\n\n

Nelle ultime settimane \u00e8 stata rilevata una nuova campagna malware contenente Agent Tesla. Di seguito un analisi del malware e dell’infrastruttura offensiva.

Link analisi Sandbox: https:\/\/app.any.run\/tasks\/1f2f6acd-d1a7-4175-a06f-38524a5f9b0d\/<\/a><\/p>\n\n\n\n

\n

Analisi del malware e dell’infrastruttura offensiva<\/strong><\/p>\n<\/div><\/div>\n\n\n\n

\n\n\n\n

Analisi dinamica<\/h3>\n\n\n\n

Albero dei processi<\/h5>\n\n\n\n

Una volta eseguito, il malware esegue l’avvio di due sottoprocessi:<\/p>\n\n\n\n

  • schtasks.exe<\/strong><\/li>
  • RegSvcs.exe<\/strong><\/li><\/ul>\n\n\n\n

    Il primo viene sfruttato per creare dei task schedulati tramite il comando:<\/p>\n\n\n\n

    “C:\\Windows\\System32\\schtasks.exe” \/Create \/TN “Updates\\ysZeGjU” \/XML “C:\\Users\\admin\\AppData\\Local\\Temp\\tmp9D6C.tmp”<\/strong> <\/p>Comando di persistenza<\/cite><\/blockquote>\n\n\n\n

    che avvia ad ogni accesso il malware ysZeGjU.exe<\/strong> <\/p>\n\n\n\n

    Il secondo sample viene identificato come Agent Tesla<\/strong>, tramite tale processo vengono eseguiti tutte le attivit\u00e0 del malware:<\/p>\n\n\n\n

    • Creazione di chiavi di registro<\/li>
    • Esfiltrazione di informazioni dai Web Browser
      • C:\\Users\\user\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini <\/strong><\/li><\/ul><\/li>
      • Esfiltrazione di informazioni personali dell’utente
        • C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini <\/strong><\/li><\/ul><\/li><\/ul>\n\n\n\n
          \"\"<\/figure>\n\n\n\n
          \n\n\n\n
          Dropped files<\/h5>\n\n\n\n

          Durante l’esecuzione del sample avviene l’unpacking <\/em>e la persistenza del malware. Processo che porta alla creazione di nuovi file:<\/p>\n\n\n\n

          • C:\\Users\\admin\\AppData\\Roaming\\NewApp\\NewApp.exe<\/strong><\/li>
          • C:\\Users\\admin\\AppData\\Roaming\\ysZeGjU.exe<\/strong> <\/li>
          • C:\\Users\\admin\\AppData\\Local\\Temp\\tmpD59.tmp <\/strong> <\/li><\/ul>\n\n\n\n

            I file ysZeGjU.exe <\/strong>\u00e8 l’effettivo malware che verr\u00e0 poi eseguito ad ogni avvio del computer per ottenere un accesso remoto e persistente.<\/p>\n\n\n\n

            \n\n\n\n
            \n
            Chiavi di registro create<\/h5>\n\n\n\n

            Tali chiavi vengono create per poter ottenere la persistenza nel sistema, consentendo l’avvio del malware ad ogni riavvio della macchina.<\/p>\n\n\n\n

            • CHIAVE <\/strong>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
              • NOME <\/strong>NewApp <\/li>
              • VALORE <\/strong>C:\\Users\\admin\\AppData\\Roaming\\NewApp\\NewApp.exe <\/li><\/ul><\/li>
              • CHIAVE <\/strong> KEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run
                • NOME <\/strong>NewApp <\/li>
                • VALORE <\/strong>C:\\Users\\admin\\AppData\\Roaming\\NewApp\\NewApp.exe<\/li><\/ul><\/li><\/ul>\n<\/div><\/div>\n\n\n\n
                  Network activity<\/h5>\n\n\n\n

                  Il malware risulta contattare il server C2 (di comando e controllo) al quale invia le informazioni sottratte alle vittime e permette il controllo remoto del sistema:<\/p>\n\n\n\n

                  • Domain <\/strong>mail[.]tradzilanilaw[.]co[.]za <\/li>
                  • IP <\/strong>69[.]46[.]6[.]238 <\/li><\/ul>\n\n\n\n

                    Come illustrato nella figura sottostante, il dominio e l’IP contattati dal sample <\/em>in analisi risulta essere stato utilizzato anche per altre campagne malware e altri malware della stessa famiglia (Agent Tesla<\/em>).<\/p>\n\n\n\n

                    \"\"<\/figure>\n\n\n\n
                    \n\n\n\n
                    \n

                    Analisi statica<\/h3>\n\n\n\n

                    Attraverso una prima analisi statica del sample iniziale<\/strong> di Agent Tesla \u00e8 possibile estrarre alcune informazioni interessati, tra cui:<\/p>\n\n\n\n

                    • md5 <\/strong>63CCA7B824B315FE272B8B4768CCB44E<\/li>
                    • sha1 <\/strong>D3B145B0C415488815B430F71EA82BA8F4289F05<\/li>
                    • sha256 <\/strong>46CE9BBD88955426CB51DB89E2767E46B5A1718B1D90407C5845B648EE8DC7C8<\/li>
                    • first-bytes-hex<\/strong> 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 <\/li>
                    • entry-point<\/strong> FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <\/li>
                    • file-version<\/strong> 0.8.0.0<\/li>
                    • cpu <\/strong>32-bit<\/li>
                    • compiler-stamp<\/strong> 0x60A58B3F (Thu May 20 00:03:43 2021)<\/li>
                    • code-page<\/strong> Unicode UTF-16, little endian<\/li>
                    • CompanyName<\/strong> Fayva<\/li>
                    • FileDescription<\/strong> wsManager<\/li>
                    • InternalName<\/strong> 8MUWA2d1M.exe<\/li>
                    • LegalCopyright <\/strong>Copyright \u00a9 Fayva<\/li>
                    • OriginalFilename<\/strong> 8MUWA2d1M.exe<\/li>
                    • ProductName<\/strong> webshellManager <\/li><\/ul>\n\n\n\n
                      \n\n\n\n
                      ysZeGjU.exe<\/h5>\n\n\n\n
                      • md5 <\/strong>63CCA7B824B315FE272B8B4768CCB44E<\/li>
                      • sha1 <\/strong>D3B145B0C415488815B430F71EA82BA8F4289F05<\/li>
                      • sha256 <\/strong>46CE9BBD88955426CB51DB89E2767E46B5A1718B1D90407C5845B648EE8DC7C8<\/li>
                      • first-bytes-hex<\/strong> 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 <\/li>
                      • imphash <\/strong>F34D5F2D4577ED6D9CEEC516C1F5A744<\/li>
                      • entry-point<\/strong> FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <\/li>
                      • file-version<\/strong> 0.8.0.0<\/li>
                      • description <\/strong>wsManager<\/li>
                      • cpu <\/strong>32-bit<\/li>
                      • compiler-stamp<\/strong> 0x60A58B3F (Thu May 20 00:03:43 2021)<\/li>
                      • CompanyName <\/strong>Fayva<\/li>
                      • FileDescription <\/strong>wsManager<\/li>
                      • FileVersion <\/strong>0.8.0.0<\/li>
                      • InternalName <\/strong>8MUWA2d1M.exe<\/li>
                      • LegalCopyright <\/strong>Copyright \u00a9 Fayva<\/li>
                      • OriginalFilename<\/strong> 8MUWA2d1M.exe<\/li>
                      • ProductName <\/strong>webshellManager <\/li><\/ul>\n\n\n\n
                        \n\n\n\n
                        NewApp.exe<\/h5>\n\n\n\n
                        • md5 <\/strong>0E06054BEB13192588E745EE63A84173<\/li>
                        • sha1 <\/strong>30B7D4D1277BAFD04A83779FD566A1F834A8D113<\/li>
                        • sha256 <\/strong>C5D6D56DED55FBD6C150EE3A0EB2E5671CAE83106BE2BE4D70CE50AA50BAB768<\/li>
                        • first-bytes-hex<\/strong> 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 <\/li>
                        • imphash <\/strong>F34D5F2D4577ED6D9CEEC516C1F5A744<\/li>
                        • entry-point<\/strong> FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <\/li>
                        • file-version<\/strong> 4.7.3062.0 built by: NET472REL1<\/li>
                        • description <\/strong>Microsoft .NET Services Installation Utility<\/li>
                        • cpu <\/strong>32-bit<\/li>
                        • compiler-stamp<\/strong> 0x5AB95109 (Mon Mar 26 21:59:05 2018 )<\/li>
                        • code-page<\/strong> Unicode UTF-16, little endian<\/li>
                        • CompanyName <\/strong>Microsoft Corporation<\/li>
                        • FileDescription <\/strong>Microsoft .NET Services Installation Utility<\/li>
                        • InternalName <\/strong>RegSvcs.exe<\/li>
                        • LegalCopyright <\/strong>\u00a9 Microsoft Corporation. All rights reserved.<\/li>
                        • OriginalFilename <\/strong>RegSvcs.exe<\/li>
                        • ProductName <\/strong>Microsoft\u00ae .NET Framework <\/li><\/ul>\n\n\n\n

                          NewApp <\/em>risulta essere il tool di Microsoft RegSvcs.exe<\/strong>, tramite cui \u00e8 possibile creare chiavi di registro.<\/p>\n\n\n\n

                          \n\n\n\n
                          tmpD59.tmp<\/strong> <\/h5>\n\n\n\n
                          • md5 <\/strong>C0089F5200712CEBEC6B695A682611B3<\/li>
                          • sha1 <\/strong>F30A3BDACB50B9CA066EC23BAB70164025ADF439<\/li>
                          • sha256 <\/strong>050749E86B5846DD70D4F2A8324B742C0F87109D7CDB356D33968AFDC57CED96<\/li>
                          • first-bytes-hex<\/strong> 3C 3F 78 6D 6C 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 65 6E 63 6F 64 69 6E 67 3D 22 55 54 46 <\/li>
                          • first-bytes-text<\/strong> < ? x m l v e r s i o n = ” 1 . 0 ” e n c o d i n g = ” U T F <\/li><\/ul>\n\n\n\n

                            Estratto del contenuto del file:<\/p>\n

                            \n

                            <LogonTrigger>
                            <Enabled>true<\/Enabled>
                            <UserId>USER-PC\\admin<\/UserId>
                            <\/LogonTrigger> <Command>C:\\Users\\admin\\AppData\\Roaming\\ysZeGjU.exe<\/Command><\/p>\n<\/blockquote>\n\n\n\n

                            Utilizzato come sistema di persistenza del malware (ysZeGjU.exe<\/strong>) ad ogni accesso dell’utente colpito.<\/p>\n<\/div><\/div>\n\n\n\n

                            \n\n\n\n

                            Altri IOC correlati ad Agent Tesla<\/h2>\n\n\n\n
                            • 69[.]46[.]6[.]238 <\/li>
                            • 192[.]185[.]226[.]148<\/li>
                            • 198[.]154[.]240[.]47<\/li>
                            • 166[.]62[.]27[.]182<\/li>
                            • 192[.]168[.]100[.]167<\/li>
                            • 69[.]16[.]231[.]57<\/li>
                            • 103[.]14[.]20[.]94<\/li>
                            • 198[.]54[.]115[.]249<\/li>
                            • 204[.]11[.]56[.]48<\/li>
                            • 199[.]188[.]206[.]58<\/li>
                            • 198[.]49[.]72[.]29<\/li>
                            • 63[.]247[.]140[.]70<\/li>
                            • 198[.]54[.]115[.]130<\/li>
                            • 198[.]54[.]116[.]236<\/li>
                            • 209[.]99[.]40[.]222<\/li>
                            • 207[.]174[.]214[.]206<\/li>
                            • 78[.]198[.]121[.]158<\/li>
                            • 104[.]194[.]10[.]93<\/li>
                            • 68[.]65[.]123[.]141<\/li>
                            • 185[.]61[.]153[.]106<\/li>
                            • 193[.]239[.]84[.]207<\/li><\/ul>\n\n\n\n
                              \n

                              Elenco degli hash degli eseguibili dei sample di Agent Tesla rilevati: <\/p>\n\n\n\n

                              • 45c22ef191a04d054c8a9e4f873c8ccfe34527944da8c9f60dbb656c7a1dd30e <\/li>
                              • 878a4f96c80d638d087347f2f4d9fd09df01b3bff20ce362c9fff16bca94e5bb<\/li>
                              • 0fbeab0e8f28875b8961f590ff42267c3e21ce9ea587a02fb9573fdfe9c4fb3c <\/li>
                              • 1137a5b1100685623a208af986d530c8f603f82e874721bdac8ce48488baf08e<\/li>
                              • 595991e7a071216bcda0f04df68de57a54f8bd31197031b4b4d473675aa285f1<\/li>
                              • f7ad9b234d31ce511b8b0915c52e8611b3a7667c71ed5ffd6cc26ce99d2ba5b4<\/li>
                              • 46ce9bbd88955426cb51db89e2767e46b5a1718b1d90407c5845b648ee8dc7c8<\/li><\/ul>\n<\/div><\/div>\n\n\n\n
                                • 46CE9BBD88955426CB51DB89E2767E46B5A1718B1D90407C5845B648EE8DC7C8<\/li>
                                • 009865EA20036C19381086A91108D419A8294DF7CF4C1DF5919D9DA1D613F4AE<\/li>
                                • 8C452BB85D7C88B9B0DD44023EC6F4D63ABD7E2AD66205B598B32A6D31F36888<\/li>
                                • 47243E179BC23FE9057253F84684C37EBE99F2E70DA2E8236F56042E64C335B5<\/li>
                                • 98377E01641DAD941B567A822A9F99C843CEFB38FE4B641D99CE0E83E3E0C498<\/li>
                                • DDE9D304BD76E5070A8837EB4B8859B8CF73F5F97154EAC84F55859CCDF01758<\/li>
                                • 824A19B9DC158B71EAFF47E2EE64688CFD315E493DF198FAB0166370488D9553<\/li>
                                • 19AA079C6DE34EB550070AA69F98C741AEFD04D8B83B1C7E23BF89576BA1B69B<\/li>
                                • BF046025515879E2A468B9FF5305EB34C927B6C3E6B1ADBE50277B24A255FC9F<\/li>
                                • 456A91ABABAF84F414409B11CCD8C3707B4BB960FF1EA7C2C4D0994786C10523<\/li>
                                • 5B8643A221D028761328525EC881250FB02840F97792557020A49A226D23E7E6<\/li>
                                • 9692D3FCBE8181EB9B964C8CE0D960A3C3F64E84E231BAA607798971C744CDE8<\/li>
                                • CC8712E3A1EF6A730A68805E62971D3DA99EFCBF120FB627D1C7315B3CA35F8B<\/li>
                                • ED16AF86E5BA09E46175311CF0EB7E3E1684ABA68ED59BE8E7327B4A47245326<\/li>
                                • 5753294933668F57E487079FFFF070BAF9D275E30798A5D9CF9D54EEFEC352C4<\/li>
                                • 82F1CEE3C16BA6868870E1B45CCF5DFB126562A42F1B3EA0DA7122A965F5A400<\/li>
                                • 34CD4FCF758566CCFD538E85988330EC7DB2C7823375448353DC7A8F9B4EB53B<\/li>
                                • C218F628B56B2316CBE236C3A15EB3AA1D138CCD85FC5D5CE76CCAA61BF75032<\/li>
                                • 0498C1E68E0FB59171E05BEE6AFDC6E4697F28FEC80BA0E9C70D4B5A7A6AD198<\/li>
                                • 90EBC7865DF4E941AACD68DD89BEA0EFCD6A082CEBCBA405FE0400C39CACD21D<\/li>
                                • C5712FAD8759DCBF70ADD6208D6E4824680DC6F452D1E63AC1F2FC1CA8B0F24F<\/li><\/ul>\n\n\n\n
                                  • mail[.]tradzilanilaw[.]co[.]za <\/li>
                                  • webmail[.]mdist[.]us<\/li>
                                  • mail[.]axes[.]com[.]pe<\/li>
                                  • mail[.]vpb[.]pe<\/li>
                                  • api[.]ip[.]sb<\/li>
                                  • www[.]newcontemporaryartists[.]com<\/li>
                                  • joophesh[.]com<\/li>
                                  • outtlook[.]com<\/li>
                                  • www[.]adblockgenesis[.]com<\/li>
                                  • concordiaoperativo[.]com<\/li>
                                  • mail[.]aceconsulting[.]in<\/li>
                                  • smtp[.]syametal[.]com<\/li>
                                  • smtp[.]robotah[.]eu<\/li>
                                  • smtp[.]globaloffs-site[.]com<\/li>
                                  • smtp[.]kaeiser[.]com<\/li>
                                  • smtp[.]frtsolutinos[.]com<\/li>
                                  • smtp[.]ternptechindia[.]com<\/li>
                                  • esclavage-indemnites[.]fr<\/li>
                                  • smtp[.]freislandcampina[.]co<\/li>
                                  • smtp[.]sierametals[.]com<\/li>
                                  • smtp[.]nilkarnal[.]com<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"

                                    Agent Tesla Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. The spyware is created using .Net software framework. It is aimed at stealing personal data and transmitting […]<\/p>\n","protected":false},"author":1,"featured_media":2409,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[25,61,75,212,285,320],"class_list":["post-2365","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-news","tag-agent","tag-c2","tag-command","tag-malware","tag-rat","tag-silver-terrier"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2365"}],"version-history":[{"count":0,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2365\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}