General

  • Target

    1111110.pdf.exe

  • Size

    732KB

  • Sample

    211022-xa7l4schbl

  • MD5

    96ba365981ceab9b90a1bdf5edeb0667

  • SHA1

    723a587b705efc8b626906f72a0cd3931b9b24d7

  • SHA256

    a6d4d40ed4005906347b782bf9b5625b9ac4adf0b2728b695e86f0e4c7cdf4c1

  • SHA512

    48c2d7a09053d6a261dc32c57193aedef363c8e99ac7b2f1fc68d02d78b73de2f0108aef5a00fe4903312ebb77a34eaf4adaf4d650a4e8ac73736241924d3d61

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    logs@chinadulokislogs.xyz
  • Password:
    CHINADUA@#asx122

Targets

    • Target

      1111110.pdf.exe

    • Size

      732KB

    • MD5

      96ba365981ceab9b90a1bdf5edeb0667

    • SHA1

      723a587b705efc8b626906f72a0cd3931b9b24d7

    • SHA256

      a6d4d40ed4005906347b782bf9b5625b9ac4adf0b2728b695e86f0e4c7cdf4c1

    • SHA512

      48c2d7a09053d6a261dc32c57193aedef363c8e99ac7b2f1fc68d02d78b73de2f0108aef5a00fe4903312ebb77a34eaf4adaf4d650a4e8ac73736241924d3d61

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Drops file in Drivers directory

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks