General

  • Target

    INGS BANK.exe

  • Size

    2.6MB

  • Sample

    200713-9776afg2en

  • MD5

    0141cdcaa3ae951a208dc042a417abe0

  • SHA1

    d08e1e17428e96c6f061009289d867c1d9cd60da

  • SHA256

    286b8cc77b9a67d2721a98af381f38bcb0bc3f416fa0a6a8417f07ac2a2ebd6f

  • SHA512

    d8967babc3d55b394c9017161d99c9c3c3a95708492fb80a966f162e1c18a1fb3e4751fcea340773ff493d5dfa4bbc156b7f9293aac9d096dec2d33f14840b3c

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.verticalmantenimiento.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    gTH^^vVWW_$c

Targets

    • Target

      INGS BANK.exe

    • Size

      2.6MB

    • MD5

      0141cdcaa3ae951a208dc042a417abe0

    • SHA1

      d08e1e17428e96c6f061009289d867c1d9cd60da

    • SHA256

      286b8cc77b9a67d2721a98af381f38bcb0bc3f416fa0a6a8417f07ac2a2ebd6f

    • SHA512

      d8967babc3d55b394c9017161d99c9c3c3a95708492fb80a966f162e1c18a1fb3e4751fcea340773ff493d5dfa4bbc156b7f9293aac9d096dec2d33f14840b3c

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks