General

  • Target

    BL DRAFT COPY.zip

  • Size

    386KB

  • Sample

    211202-js6wmsgac9

  • MD5

    d279bed4378fcb92e73a5a0ad93f4e74

  • SHA1

    e70600a8d8f0095b536f50651392596c9b5c884e

  • SHA256

    9af12a20c1c19bf81ba50b2f48b4fc067f9ef650dece4b5972be9568a8fd1d32

  • SHA512

    24123daa8839f22eae8ba8e7d59ef4c26ee9dfaba2c1839dbb512a34a1c2ee98745aeb266b4d64937a1c625374f8c2b291ba69741ca3ab2d36c1e27ea6d9223c

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.khawambros.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    1EJRh0xnEN549JSbdZHz

Targets

    • Target

      BL DRAFT COPY.exe

    • Size

      482KB

    • MD5

      c19417f92b007af50ba9ae328c693d0f

    • SHA1

      7eddf0cf2dcf2546e7d679bcd1341591c6f5d3ae

    • SHA256

      ef0c12e1c56d5e674a83f56e8e21b485bdcf7d45e0c97e02669d5e8604cebafc

    • SHA512

      700153ca06ca6b43a053db6ac1ead5e9de6e3f27426dd362d67fe5fe5064948c56847503965c2846f0304a2365d5f34f1fdd119c445770e1272b68926b5d9041

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks