General

  • Target

    PICTURE DRAWING DESIGN.exe

  • Size

    986KB

  • Sample

    211130-jxpsxshec2

  • MD5

    bbc6caf6cfe3428798205216c2df85e1

  • SHA1

    ac68d4c0eb019bb5586057d2deb2174af18ad45a

  • SHA256

    eb869a427757689033110327cdcfbe5d406a47f60b3529b8903b0d00c1deb6e3

  • SHA512

    51dfda000e6dbb2f142c09e129b6fd87884ef3b642d289d69e2ceeee57d95386f22372bfb18038225d7bf37d5521776d7f072a2af174e1cfeb27d1df2565707b

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.schoolofspanish.co.za
  • Port:
    587
  • Username:
    vds@schoolofspanish.co.za
  • Password:
    %pJ@=BsZ?pQv

Targets

    • Target

      PICTURE DRAWING DESIGN.exe

    • Size

      986KB

    • MD5

      bbc6caf6cfe3428798205216c2df85e1

    • SHA1

      ac68d4c0eb019bb5586057d2deb2174af18ad45a

    • SHA256

      eb869a427757689033110327cdcfbe5d406a47f60b3529b8903b0d00c1deb6e3

    • SHA512

      51dfda000e6dbb2f142c09e129b6fd87884ef3b642d289d69e2ceeee57d95386f22372bfb18038225d7bf37d5521776d7f072a2af174e1cfeb27d1df2565707b

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks