PRICE LIST NOVEMBER 2020.ace

General
Target

PRICE LIST NOVEMBER 2020.ace

Size

13KB

Sample

210223-qgh579r5h2

Score
10 /10
MD5

4a47af55d3c04a64680bed3e707519c6

SHA1

ec05cee69cf370f964271688a39202c3cd91b845

SHA256

166f9ddac4f381622af720acf9825df9cd1b6b59f99f246e64891e61d62710f3

SHA512

24ca4c37c3f60ced4c8b1e11bcb72173a048d386b16943b802f10dba7fec62b0708e477306a97e20468ef84ff0ef2a67f00871c5d8f097a4c17b44a90e552c01

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.electrobelarmino.pt

Port: 587

Username: jose.carvalho@electrobelarmino.pt

Password: 4WFbZhWVf.I6

Targets
Target

PRICE LIST (NOVEMBER 2020).exe

MD5

404ef05a6acc67c2b59189171f9eb0fc

Filesize

31KB

Score
10 /10
SHA1

0ecf315e5a72a3c9ddd386d1116d2265877b4027

SHA256

863d464bb43bda7378c611a5c16410a3c279ca72e447632f5e03f8418f5464d8

SHA512

19ea2b67ef1661bcb5c2bb9640970ad8f3c734958853cd98045eb79b833d3b3bbfa0af59b1cf49e7175e9fa0d3dc3d4dfe75ce97fb6053b6f94d18510a296c0a

Tags

Signatures

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Description

    Tries to access configuration files associated with programs like FileZilla.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local System Credentials in Files
  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Tasks