General

  • Target

    Ziraat Bankasi Swift Mesaji.exe

  • Size

    795KB

  • Sample

    210118-qj7wq78n4a

  • MD5

    183089d92b8dbc8afb85d3d0b375a141

  • SHA1

    a25995a45828bd89bebaa1a4ac7e47f4359abd98

  • SHA256

    0e81896772127240d2f2123875bc1b2f91f93dbfe28ccf708f6bec330d7cf025

  • SHA512

    0dd217d2cfc70d7cd91a110611a7f2ad5add3ab555dedb6abd38400adb6f36ad635b18dd93ede099b20deb398eb05b6bdac5e77e421368ec080943a43c7a9f1e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.beratun.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    134679berat

Targets

    • Target

      Ziraat Bankasi Swift Mesaji.exe

    • Size

      795KB

    • MD5

      183089d92b8dbc8afb85d3d0b375a141

    • SHA1

      a25995a45828bd89bebaa1a4ac7e47f4359abd98

    • SHA256

      0e81896772127240d2f2123875bc1b2f91f93dbfe28ccf708f6bec330d7cf025

    • SHA512

      0dd217d2cfc70d7cd91a110611a7f2ad5add3ab555dedb6abd38400adb6f36ad635b18dd93ede099b20deb398eb05b6bdac5e77e421368ec080943a43c7a9f1e

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks