General

  • Target

    Origin servers new.exe

  • Size

    216KB

  • Sample

    211020-phrlvshhfq

  • MD5

    38992f89f1a9d4d7e16f8cff9e8e8ad9

  • SHA1

    207be3e63230690f3c6ff9cd41cdb43c6e9e2db6

  • SHA256

    c9d04b3ac53e334d686acf5da700e79dc31a6bff316f14f552d43a86203f9423

  • SHA512

    17fab343aaa11ef61b5b0bb2219f95f744c792b837f35fd176ff0d5626e885721a4e01727d254cb7d8da241a9469a1792d568e67ce68629132a4374d5142b800

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    komero103online

Targets

    • Target

      Origin servers new.exe

    • Size

      216KB

    • MD5

      38992f89f1a9d4d7e16f8cff9e8e8ad9

    • SHA1

      207be3e63230690f3c6ff9cd41cdb43c6e9e2db6

    • SHA256

      c9d04b3ac53e334d686acf5da700e79dc31a6bff316f14f552d43a86203f9423

    • SHA512

      17fab343aaa11ef61b5b0bb2219f95f744c792b837f35fd176ff0d5626e885721a4e01727d254cb7d8da241a9469a1792d568e67ce68629132a4374d5142b800

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks