General

  • Target

    74tF1foMeQyUMCh.exe

  • Size

    764KB

  • Sample

    210126-ay5xv7mrgx

  • MD5

    350c227dfc45a79250d681348f5ad96a

  • SHA1

    8aa4e6ca4c377f51e714798a93c95d9bd13a2e71

  • SHA256

    23efc97e61f8218480cd1b89de603d517f0b31ee4fe9e2bf1f83bcb38e242827

  • SHA512

    a948ea31cd103354376a254341354aaa2929822d944238564f33f004a6ce866934af41d1cf8959106415ee7e3d6754e0165daf459daf9cc28ec80c2429d2ef42

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.cefortem.cat
  • Port:
    587
  • Username:
    presidencia@cefortem.cat
  • Password:
    Vft284Rpyn

Targets

    • Target

      74tF1foMeQyUMCh.exe

    • Size

      764KB

    • MD5

      350c227dfc45a79250d681348f5ad96a

    • SHA1

      8aa4e6ca4c377f51e714798a93c95d9bd13a2e71

    • SHA256

      23efc97e61f8218480cd1b89de603d517f0b31ee4fe9e2bf1f83bcb38e242827

    • SHA512

      a948ea31cd103354376a254341354aaa2929822d944238564f33f004a6ce866934af41d1cf8959106415ee7e3d6754e0165daf459daf9cc28ec80c2429d2ef42

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks