General

  • Target

    PG4636 - Confirmed .xls.zip

  • Size

    445KB

  • Sample

    211201-rqrb6schbr

  • MD5

    be067ef8a7a292aad57ce40ea68fc580

  • SHA1

    046ccf6ebbc5fbd38d7bc75e7846237829ce495b

  • SHA256

    afa5a92d8aacd7771dcb1c0a3e9151b5d3639e5b5d6661a0583ea9d93b967db8

  • SHA512

    299baa7e55d7fde9f4260e0274af2701b70803b0dbf141154b12bb4eb1b2801c3f9f8b167b24ec22fd21fa083a11c916f27f1b6cadd1ec716555dab887f298c5

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.neocomjsp.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    f@kHRCt0

Targets

    • Target

      PG4636 - Confirmed .xls.exe

    • Size

      487KB

    • MD5

      3ab8e681d5b85174421e23d5b3bace3f

    • SHA1

      60cfc87431a251f2fd1f1b1d3069999308de31a8

    • SHA256

      2a5ae6a4afc8079db51da67e5823ba3c8fd78da234952b0a02ad084764fed3ab

    • SHA512

      55c85a222aa4927ff85801af1674d0dc1843e38f0f8024f28e727bf009592ba967a536883b6e1717a84ca3e6d499a74268eee2728d47be3808759c8848e92d0a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks