General

  • Target

    f1e1efbc90e741f9e20373154e63114d.exe

  • Size

    1.2MB

  • Sample

    210111-5smg7btkw6

  • MD5

    f1e1efbc90e741f9e20373154e63114d

  • SHA1

    39335fcf35520de04e33523c43f8fea23125484f

  • SHA256

    881cfce526214c0118fb0eac33a64d0c6ed6a278538a2f6cf28b059e4cb761ff

  • SHA512

    afd356b6f78b7f9e7af1aaadd994fad44d7fd45250ba7185c7abffcb5997ea571c1c3321c1b44f58b552795f98e84862de80133184f407c18c02656fa301a593

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    novget.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    0l7PKJauRv

Targets

    • Target

      f1e1efbc90e741f9e20373154e63114d.exe

    • Size

      1.2MB

    • MD5

      f1e1efbc90e741f9e20373154e63114d

    • SHA1

      39335fcf35520de04e33523c43f8fea23125484f

    • SHA256

      881cfce526214c0118fb0eac33a64d0c6ed6a278538a2f6cf28b059e4cb761ff

    • SHA512

      afd356b6f78b7f9e7af1aaadd994fad44d7fd45250ba7185c7abffcb5997ea571c1c3321c1b44f58b552795f98e84862de80133184f407c18c02656fa301a593

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies WinLogon for persistence

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks