General

  • Target

    PO13132021.exe

  • Size

    708KB

  • Sample

    210126-1gzg7g5p1a

  • MD5

    fdf61d93bd142badc9cec0773400f9de

  • SHA1

    dc3aed7314d960d7d2fb89b58cb8e13510b93aa2

  • SHA256

    263ef0b82b77fd9aa3c5e6b8811aab7798c28126e13b9561f45bfec1e4df61a3

  • SHA512

    8b3e86b5c80b085827d6a052b9dea7c6db99e8bd98bb2ee1e421fdbf85120a6d14e1d26226335e33e78c26ecc7860e20b5b55aa1647cafdb149226c3aeb6285a

Malware Config

Targets

    • Target

      PO13132021.exe

    • Size

      708KB

    • MD5

      fdf61d93bd142badc9cec0773400f9de

    • SHA1

      dc3aed7314d960d7d2fb89b58cb8e13510b93aa2

    • SHA256

      263ef0b82b77fd9aa3c5e6b8811aab7798c28126e13b9561f45bfec1e4df61a3

    • SHA512

      8b3e86b5c80b085827d6a052b9dea7c6db99e8bd98bb2ee1e421fdbf85120a6d14e1d26226335e33e78c26ecc7860e20b5b55aa1647cafdb149226c3aeb6285a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks