General

  • Target

    20372054c8b59a03677088b4c9f237e3

  • Size

    458KB

  • Sample

    211203-myek5agbcn

  • MD5

    20372054c8b59a03677088b4c9f237e3

  • SHA1

    063e2810e44ac8808bc0ae0471441ffc37a85c7e

  • SHA256

    2d40b12c6aaeb711a05c114a3147fd6139d893197a0b9787bb718199e99fe5cb

  • SHA512

    98babf6c128b4d39cb71498c5bc5d5883d3bc5084bd10b2b1bea16a248291aff4b386085a4d27392df3abadd0b4f5f769dbee337e0d45fd871180fb99850b44d

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sementescaicara.com.br
  • Port:
    587
  • Username:
    coordenador@sementescaicara.com.br
  • Password:
    sementes4062

Targets

    • Target

      20372054c8b59a03677088b4c9f237e3

    • Size

      458KB

    • MD5

      20372054c8b59a03677088b4c9f237e3

    • SHA1

      063e2810e44ac8808bc0ae0471441ffc37a85c7e

    • SHA256

      2d40b12c6aaeb711a05c114a3147fd6139d893197a0b9787bb718199e99fe5cb

    • SHA512

      98babf6c128b4d39cb71498c5bc5d5883d3bc5084bd10b2b1bea16a248291aff4b386085a4d27392df3abadd0b4f5f769dbee337e0d45fd871180fb99850b44d

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies WinLogon for persistence

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks