General

  • Target

    Request for quotation.exe

  • Size

    346KB

  • Sample

    211022-jwkskscbgq

  • MD5

    eb10234a0a4f57d5b23d17eb663e0a85

  • SHA1

    1dcfa0eaeff6d2891d5708c0598a8a4ee64b3a0a

  • SHA256

    b6ed29e0da8d78835a66a6c4560548e37ae59ab79451429c6d818f8cc43173bd

  • SHA512

    446d1c18b760dac482ca4fcc6ed0f65d34c9267625c1d7d49077116d8c8ddfdb0a60789692f68e18dd7c2996c11cba734c8ead065ea29b9612dcc937845a1547

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1803146213:AAHYyCRx7FggQ9LfPbrIs79ZUWCEc9wNnDo/sendDocument

Targets

    • Target

      Request for quotation.exe

    • Size

      346KB

    • MD5

      eb10234a0a4f57d5b23d17eb663e0a85

    • SHA1

      1dcfa0eaeff6d2891d5708c0598a8a4ee64b3a0a

    • SHA256

      b6ed29e0da8d78835a66a6c4560548e37ae59ab79451429c6d818f8cc43173bd

    • SHA512

      446d1c18b760dac482ca4fcc6ed0f65d34c9267625c1d7d49077116d8c8ddfdb0a60789692f68e18dd7c2996c11cba734c8ead065ea29b9612dcc937845a1547

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks