General

  • Target

    QUOTE 7129.bat

  • Size

    567KB

  • Sample

    211014-ggcsbagce7

  • MD5

    c5cc1718876b11652a056bfb7c819521

  • SHA1

    37beee9cd4da05c76e9e79a98e824d7f103bf986

  • SHA256

    bd6fb4af1ac12b02fdfa5df9ce0094710fab6415f3154cdcc6c1e5d8b7f351a1

  • SHA512

    547edba7ff818c915e9fa6c16ea2c8ad214afcdef4049aea72a18d6e64243ba227fa8ec77d5232e7f36ab14f9bbae657adce82a3b77f33616d44a552eaf15e45

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.rapidmail.ec
  • Port:
    587
  • Username:
    anams@rapidmail.ec
  • Password:
    icui4cu2@@

Targets

    • Target

      QUOTE 7129.bat

    • Size

      567KB

    • MD5

      c5cc1718876b11652a056bfb7c819521

    • SHA1

      37beee9cd4da05c76e9e79a98e824d7f103bf986

    • SHA256

      bd6fb4af1ac12b02fdfa5df9ce0094710fab6415f3154cdcc6c1e5d8b7f351a1

    • SHA512

      547edba7ff818c915e9fa6c16ea2c8ad214afcdef4049aea72a18d6e64243ba227fa8ec77d5232e7f36ab14f9bbae657adce82a3b77f33616d44a552eaf15e45

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks