General

  • Target

    PG4636 - Confirmed .xls.exe

  • Size

    487KB

  • Sample

    211201-rqrb6sfhe4

  • MD5

    3ab8e681d5b85174421e23d5b3bace3f

  • SHA1

    60cfc87431a251f2fd1f1b1d3069999308de31a8

  • SHA256

    2a5ae6a4afc8079db51da67e5823ba3c8fd78da234952b0a02ad084764fed3ab

  • SHA512

    55c85a222aa4927ff85801af1674d0dc1843e38f0f8024f28e727bf009592ba967a536883b6e1717a84ca3e6d499a74268eee2728d47be3808759c8848e92d0a

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.neocomjsp.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    f@kHRCt0

Targets

    • Target

      PG4636 - Confirmed .xls.exe

    • Size

      487KB

    • MD5

      3ab8e681d5b85174421e23d5b3bace3f

    • SHA1

      60cfc87431a251f2fd1f1b1d3069999308de31a8

    • SHA256

      2a5ae6a4afc8079db51da67e5823ba3c8fd78da234952b0a02ad084764fed3ab

    • SHA512

      55c85a222aa4927ff85801af1674d0dc1843e38f0f8024f28e727bf009592ba967a536883b6e1717a84ca3e6d499a74268eee2728d47be3808759c8848e92d0a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks