General

  • Target

    5555555000000000.exe

  • Size

    739KB

  • Sample

    200714-pwse3mmtm2

  • MD5

    4dd6e8b706a8b9b1c9d79ae68aa2162a

  • SHA1

    ea7b82c7e32ebbaaf52e2a646f33643cba26c189

  • SHA256

    7a3c761d105aebdfc06ce56ef43ba47d374ba81cc1d64d5380054cccbd92bd57

  • SHA512

    52698478ccca80480d51d7163d3581d366372801ca67978d0233b1f13db158a4d47aa3699727e0f7b65e5b9c3de6d177052beac69d91b4e2e8ec4309e42a079f

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sensar-light.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    505012345@@@@@

Targets

    • Target

      5555555000000000.exe

    • Size

      739KB

    • MD5

      4dd6e8b706a8b9b1c9d79ae68aa2162a

    • SHA1

      ea7b82c7e32ebbaaf52e2a646f33643cba26c189

    • SHA256

      7a3c761d105aebdfc06ce56ef43ba47d374ba81cc1d64d5380054cccbd92bd57

    • SHA512

      52698478ccca80480d51d7163d3581d366372801ca67978d0233b1f13db158a4d47aa3699727e0f7b65e5b9c3de6d177052beac69d91b4e2e8ec4309e42a079f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks