General

  • Target

    Payment Advice_20240424.exe

  • Size

    699KB

  • Sample

    240428-lcgb6acg5t

  • MD5

    2a1173846e35c629fb7a06d3c075bf4c

  • SHA1

    1c69c6e36c60708e84d84ba64d7970bc76440f05

  • SHA256

    d7c3896d1f9781722e74aa0bbc807a5511b44c278bb9003a169208a8c595076b

  • SHA512

    f471b9e3062625eb62c3306e644399ef4957571a35f0c14783a5c84db90940fd7dc254e66923855edfdeea0526444f519b5cabc038639abb59c4009ada01d1d2

  • SSDEEP

    12288:mNgLeFR6r0clv312Z3X3HAhhFmx41/DnQoMnCvR0Zk6Fj3Cb/jQvfhKh07PayCQM:qcJ312ZXwFw4pnQoim0ZkaCL6h7vVX2v

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.innomedjsc.com
  • Port:
    587
  • Username:
    nhung.hth@innomedjsc.com
  • Password:
    s]~5ai)IFpr-
  • Email To:
    info@jlnli.com

Targets

    • Target

      Payment Advice_20240424.exe

    • Size

      699KB

    • MD5

      2a1173846e35c629fb7a06d3c075bf4c

    • SHA1

      1c69c6e36c60708e84d84ba64d7970bc76440f05

    • SHA256

      d7c3896d1f9781722e74aa0bbc807a5511b44c278bb9003a169208a8c595076b

    • SHA512

      f471b9e3062625eb62c3306e644399ef4957571a35f0c14783a5c84db90940fd7dc254e66923855edfdeea0526444f519b5cabc038639abb59c4009ada01d1d2

    • SSDEEP

      12288:mNgLeFR6r0clv312Z3X3HAhhFmx41/DnQoMnCvR0Zk6Fj3Cb/jQvfhKh07PayCQM:qcJ312ZXwFw4pnQoim0ZkaCL6h7vVX2v

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Collection

Data from Local System

4
T1005

Tasks