General

  • Target

    RFQ_Doc_09009875754535453434_pdf.exe

  • Size

    421KB

  • Sample

    201109-1dwfwf1yma

  • MD5

    718f47212a12dfd1b2a8a299bf51c836

  • SHA1

    620db0326b59bf3f2745c97277cf6a0d3891d19c

  • SHA256

    613827162ed2e2f89c9f0e9324057b27996e9f6fd25f0cf0e7b0d275987cfdfa

  • SHA512

    ccf795d97b59fc2901051b931f1e3383d9f125f7975b2fc5c38b07279f52f57109b257001427903aec163827888227fa67d73b77aa9ee3bcd0d48124d8e71260

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    yin.l3e@yandex.ru
  • Password:
    yin.l3e@@bill3

Targets

    • Target

      RFQ_Doc_09009875754535453434_pdf.exe

    • Size

      421KB

    • MD5

      718f47212a12dfd1b2a8a299bf51c836

    • SHA1

      620db0326b59bf3f2745c97277cf6a0d3891d19c

    • SHA256

      613827162ed2e2f89c9f0e9324057b27996e9f6fd25f0cf0e7b0d275987cfdfa

    • SHA512

      ccf795d97b59fc2901051b931f1e3383d9f125f7975b2fc5c38b07279f52f57109b257001427903aec163827888227fa67d73b77aa9ee3bcd0d48124d8e71260

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • rezer0

      Detects ReZer0, a packer with multiple versions used in various campaigns.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks