General

  • Target

    PAYMENT BANK INSTRUCTIONS COPY.r15

  • Size

    417KB

  • Sample

    211021-hnmrjahhh6

  • MD5

    35de863a1217eaa463f1c81be29bde3a

  • SHA1

    07d2d605b89b3dd134ce26be5122c5233648e196

  • SHA256

    b7547d2885080e93c770c9dd802920c77738c681e937db7e4ae796ad66942118

  • SHA512

    fa955d5b1f420b7dbadd4ae056744450e9165151aadd26e1e6fe8386a04dfbdda0bc47e3597446a93ff6ac3949f5ae39f509ce9aa3a4e00286b62e7fb163409e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    sg2plcpnl0023.prod.sin2.secureserver.net
  • Port:
    587
  • Username:
    nbsupports@seshsupports.com
  • Password:
    User@40378

Targets

    • Target

      PAYMENT BANK INSTRUCTIONS COPY.exe

    • Size

      478KB

    • MD5

      3087381212aa30da9121ca4fce4dc49c

    • SHA1

      d705ee1d3e4be5523d137bafbd4ea87f7c77f057

    • SHA256

      0ba4135b330637a98320e9ee0655cd3fa0423998e9fdf54b0e8e0ac85ba0f93f

    • SHA512

      4f07a2c6b7b9e4ee31d2133dfb420782a23b23d96c34197cadc2003d765ad46a4bd99231e01494ca918edcfbba0a67201934aae7fd03c1f6a42f119f9560c61b

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Collection

Email Collection

1
T1114

Tasks