General

  • Target

    BASE DE DADOS - Santa Clara.exe

  • Size

    540KB

  • Sample

    200707-7jerzlynve

  • MD5

    317bd5395431d410b617be9a4ce773e6

  • SHA1

    d903cd722862865f0b5441793ba7416cb88ff4d6

  • SHA256

    bc58f26c79cc8330e384f602bd129a25103576a1520c5fbc2c27abef784ae1de

  • SHA512

    e3f7af2ca104bdcfecb9d4b460568677de01857c67fdbd4e1d05e60369d0ce7873e6733ffb57bda2c8e5b772783e191c8673eeb59ad1c43a9073044ef8c1baf2

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.epaindemgroup.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    }bf9e+EW5s$k

Targets

    • Target

      BASE DE DADOS - Santa Clara.exe

    • Size

      540KB

    • MD5

      317bd5395431d410b617be9a4ce773e6

    • SHA1

      d903cd722862865f0b5441793ba7416cb88ff4d6

    • SHA256

      bc58f26c79cc8330e384f602bd129a25103576a1520c5fbc2c27abef784ae1de

    • SHA512

      e3f7af2ca104bdcfecb9d4b460568677de01857c67fdbd4e1d05e60369d0ce7873e6733ffb57bda2c8e5b772783e191c8673eeb59ad1c43a9073044ef8c1baf2

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks