General

  • Target

    813641BENTELERdeMéxicoSAdeCV202110193434322.exe

  • Size

    385KB

  • Sample

    211019-rdv5lafhg5

  • MD5

    2f80f873ad25314e7c4d18c2f850744e

  • SHA1

    6d96cfb8544acd55876a89bfd2c892845d9249c4

  • SHA256

    01ef7277bcd8f0ac5259da0e72f1331ed250624a15e74fa44ac9c0f9dcaea096

  • SHA512

    9f895fbc860239e8683d1809b551daa571dafdb5c22bee651f5ebc0d3264eef9df879fbbb98c4bbf46f70255e3bf8d2bdb8f4f5da0190a9c04fb00812cd1b5e4

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.comansi.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    JUGuete$2021

Targets

    • Target

      813641BENTELERdeMéxicoSAdeCV202110193434322.exe

    • Size

      385KB

    • MD5

      2f80f873ad25314e7c4d18c2f850744e

    • SHA1

      6d96cfb8544acd55876a89bfd2c892845d9249c4

    • SHA256

      01ef7277bcd8f0ac5259da0e72f1331ed250624a15e74fa44ac9c0f9dcaea096

    • SHA512

      9f895fbc860239e8683d1809b551daa571dafdb5c22bee651f5ebc0d3264eef9df879fbbb98c4bbf46f70255e3bf8d2bdb8f4f5da0190a9c04fb00812cd1b5e4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks