General

  • Target

    greattastesmb.ca_wp_content_plugins_duplicator_files_jiz.exe.malw

  • Size

    277KB

  • Sample

    200708-9tyrdrpvfe

  • MD5

    cacc88f2d5f39e672ea5a23a45afeb41

  • SHA1

    e11de0b60ae05050994ca65df594bf0974add77c

  • SHA256

    4c527bf526ae074003fa8688bb2bc55d0dfcf3712fc2e0bafefa1ca09b00e97f

  • SHA512

    bceae89a3190453750067af54d24f6696715312112f4b72c51cbf189d52b2b6d9f02f645dbdc8a8e5458d09506f4569ada784f6e4e8cdb24ccaa01b0c67b1f53

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    terminal6.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    KjmOE%DvpSvC

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    terminal6.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    KjmOE%DvpSvC

Targets

    • Target

      greattastesmb.ca_wp_content_plugins_duplicator_files_jiz.exe.malw

    • Size

      277KB

    • MD5

      cacc88f2d5f39e672ea5a23a45afeb41

    • SHA1

      e11de0b60ae05050994ca65df594bf0974add77c

    • SHA256

      4c527bf526ae074003fa8688bb2bc55d0dfcf3712fc2e0bafefa1ca09b00e97f

    • SHA512

      bceae89a3190453750067af54d24f6696715312112f4b72c51cbf189d52b2b6d9f02f645dbdc8a8e5458d09506f4569ada784f6e4e8cdb24ccaa01b0c67b1f53

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks