General

  • Target

    sample_40.exe

  • Size

    217KB

  • Sample

    211020-1afeeaaecj

  • MD5

    14130b3d5c550a284dfce9bc0d3a8366

  • SHA1

    f6d5ae57e2e6a92a958209c37bbe0081c4de1ea2

  • SHA256

    414f2dcbc980b5189bab801cf3a2570d7c7126e999d21ad2ea287ace675f23ff

  • SHA512

    3308bd8a67aa365d0ec5fa69acf5d990173d7bbdef10abcda76b537a8f0ffd1c4e7f7238294a0b0a9700fc58259598d24e91cf6296e8eca64765c9f4325758f8

Malware Config

Extracted

Family

agenttesla

C2

http://69.174.99.181/webpanel-trade/mawa/6077ebc1143fe7254b31.php

Targets

    • Target

      sample_40.exe

    • Size

      217KB

    • MD5

      14130b3d5c550a284dfce9bc0d3a8366

    • SHA1

      f6d5ae57e2e6a92a958209c37bbe0081c4de1ea2

    • SHA256

      414f2dcbc980b5189bab801cf3a2570d7c7126e999d21ad2ea287ace675f23ff

    • SHA512

      3308bd8a67aa365d0ec5fa69acf5d990173d7bbdef10abcda76b537a8f0ffd1c4e7f7238294a0b0a9700fc58259598d24e91cf6296e8eca64765c9f4325758f8

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks