General

  • Target

    FAX_INVOICE8760106 Payment-(669-818-8669).rar

  • Size

    446KB

  • Sample

    211022-rnp2bscfcq

  • MD5

    aeedc8363859a1b02c76ce9eea91fb57

  • SHA1

    9bfe7fa91e147c85d7c54c8399583c94571c8903

  • SHA256

    22cb2f4da7226fbfe2dea360ebca6744eb91f97f51354e7c1f9d49236dc34c95

  • SHA512

    aef233d9a0420693139b2728d921744fcbbc89bae00c1ca17b81fa105f791ef78c4999c860f89b1f4fe098d20913b5396540e72cd5962174d6c65776c27bd706

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    sales@tanimas-id.com
  • Password:
    !xgapua3

Targets

    • Target

      FAX_INVOICE8760106 Payment-(669-818-8669).exe

    • Size

      722KB

    • MD5

      6895cd6c93e282c5776c902af458cbac

    • SHA1

      6c1033e59d7396e8c3116428d1bdf28f6a868bc6

    • SHA256

      ab09a0694b65b155701d6efe5d08e1ed51b45d2b884496a4cb76703605cfcbf3

    • SHA512

      a3d7627447799f1c719daefa0bb3bd73f6986944b5cd391ed30b16ec2339dc6c1d7f52e5f5cd9cfedbc8013ea5c6b552d35ad22237438874f61aaed50085a0ad

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks