General

  • Target

    f0006fd49e0257418ac267fb66d2cd7212e63ab146a187f9ce98c99eed7cb3e8

  • Size

    752KB

  • Sample

    220520-2s9awabaan

  • MD5

    9c058c43ae5c96bd6c88589e9e6e7b2b

  • SHA1

    18326ddec5754237b79fdc2d9e6ba449d82396a2

  • SHA256

    f0006fd49e0257418ac267fb66d2cd7212e63ab146a187f9ce98c99eed7cb3e8

  • SHA512

    80592f769aba8ecfaea32300fba1590ae3cfa794a0713682c9d7de5d12bebc1edc3bd357b42bcb6a3c7dbdd69a91cbfc64537ff13ef9426141a69a4b65112e59

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.albaniandailynews.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    125875.jUkT

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.albaniandailynews.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    125875.jUkT

Targets

    • Target

      f0006fd49e0257418ac267fb66d2cd7212e63ab146a187f9ce98c99eed7cb3e8

    • Size

      752KB

    • MD5

      9c058c43ae5c96bd6c88589e9e6e7b2b

    • SHA1

      18326ddec5754237b79fdc2d9e6ba449d82396a2

    • SHA256

      f0006fd49e0257418ac267fb66d2cd7212e63ab146a187f9ce98c99eed7cb3e8

    • SHA512

      80592f769aba8ecfaea32300fba1590ae3cfa794a0713682c9d7de5d12bebc1edc3bd357b42bcb6a3c7dbdd69a91cbfc64537ff13ef9426141a69a4b65112e59

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks