General

  • Target

    d4444398dcb1366ac99eb1074031d5db

  • Size

    535KB

  • Sample

    211019-lwnkksgeal

  • MD5

    d4444398dcb1366ac99eb1074031d5db

  • SHA1

    abc8ce0f06f0d726b99e85818b29df163161725d

  • SHA256

    6127a09a636fac38861b7d547f31797ba41aaf9eccd825a580a27bdddd6c01d9

  • SHA512

    d53d544044407256768ced8b11e7e1eb795e133d206ab4d8b3d7eb95a673eff282f3e4360f0ac32132ff3743eff18854f4ce53288fa0a3df22c8634001075e4d

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sgsabah.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Newlife8

Targets

    • Target

      d4444398dcb1366ac99eb1074031d5db

    • Size

      535KB

    • MD5

      d4444398dcb1366ac99eb1074031d5db

    • SHA1

      abc8ce0f06f0d726b99e85818b29df163161725d

    • SHA256

      6127a09a636fac38861b7d547f31797ba41aaf9eccd825a580a27bdddd6c01d9

    • SHA512

      d53d544044407256768ced8b11e7e1eb795e133d206ab4d8b3d7eb95a673eff282f3e4360f0ac32132ff3743eff18854f4ce53288fa0a3df22c8634001075e4d

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks