General

  • Target

    cda5c7299b8e0d3d7c4d16bc5d8a79bd.rar

  • Size

    380KB

  • Sample

    211021-nb68asbafk

  • MD5

    cda5c7299b8e0d3d7c4d16bc5d8a79bd

  • SHA1

    e55bb2f8359dea973be46dec83f8f0e4ad8ec049

  • SHA256

    7260f521f888039c4c336f402f915c836c38e26b68c4e0ec61238848e567a876

  • SHA512

    5972b87217704d5ae3b018802f0da6aa2f9c5bb0ce475841991b6533dd6938443635f7d7664c971db5c7f3a52fe06ffed2cbdb6ada800d4aaeafe6366eccefb9

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    srodriguez@beticco.com
  • Password:
    C%)%GWZe9

Targets

    • Target

      Request for quotation (RFQ) pdf.exe

    • Size

      443KB

    • MD5

      8fae956cfdd27697a8745eabf8bcb1b7

    • SHA1

      8d1d36677c019a278c424fce5d82757c28988dda

    • SHA256

      eb1787166fb170e5c3b3c0761d22b2263bb86361bab75d2cad1ebf1d8395a1dd

    • SHA512

      357e737f3bd4336ef6d62a37e36b7099e847818b2098691014bca69913a84e2416e88adea6e750b93fc0d9505d5c8faaeb999e039d57792ced75760791dac138

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks