General

  • Target

    086A75D9682C5FD127AE14B5B6BEE28797F7D83890D077DB5580D37EF6E13EF1

  • Size

    413KB

  • Sample

    211019-kqzvzsgchq

  • MD5

    42daf82fa6d818b499c60a8e688a5ae0

  • SHA1

    b646a57d3255156a5510fc55a0c727339a79cd20

  • SHA256

    086a75d9682c5fd127ae14b5b6bee28797f7d83890d077db5580d37ef6e13ef1

  • SHA512

    b16149d4bcdb0c2239e9a92bfdb5c4df0e82f08c2df5a8637a859504a1f8bf47482f72c5251fda92d3cc166a9daa5685951445208677ddff5ea8fc3d6a92a84e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.medicare-equipment.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    AllTheBest777

Targets

    • Target

      rKcYGbHqqjUGRo5.exe

    • Size

      519KB

    • MD5

      34442cce45a4466045fe1748ec4b652b

    • SHA1

      74eb4fca763ed077169795e1a9d20a8d5d697e19

    • SHA256

      bd17aef5a6e188bd70166012321f6e131a403a6b663df81be05d9f104a4718a7

    • SHA512

      a5f1d55c1c9d0344cf5111a6438a49300c097fb8bf4350495d5c2795c6a547799fe5c5660af7b3f8e41d7aa77f255457ae29cfb9e3b0d7b03f989ac11c1ac5d6

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks