General

  • Target

    Order 4503860408.exe

  • Size

    31KB

  • Sample

    210511-8d12jgfmva

  • MD5

    0888f0a595168ba009400babfe2e7a2d

  • SHA1

    f84aa6d3fe9dc66f27a49bd94b9057a19aa66e0a

  • SHA256

    ce7554fa09d44e22a27ff09a105b6a50c26b1b7476b79a6c18941bb6b7d96b30

  • SHA512

    0decd4df19a8dfdbbec21165881368c303d09d98bfc12447768f83d10fa649df5fb6166915b88fc18e55af6a515360f5f0c00aec492bcd851494a2106a80f8f0

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1703315481:AAF9ojcRH3Y4Iq9oLNsz7JFyV4u3ph8lCtU/sendDocument

Targets

    • Target

      Order 4503860408.exe

    • Size

      31KB

    • MD5

      0888f0a595168ba009400babfe2e7a2d

    • SHA1

      f84aa6d3fe9dc66f27a49bd94b9057a19aa66e0a

    • SHA256

      ce7554fa09d44e22a27ff09a105b6a50c26b1b7476b79a6c18941bb6b7d96b30

    • SHA512

      0decd4df19a8dfdbbec21165881368c303d09d98bfc12447768f83d10fa649df5fb6166915b88fc18e55af6a515360f5f0c00aec492bcd851494a2106a80f8f0

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Downloads MZ/PE file

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks