General

  • Target

    e2b982e6aed9e786f3ffdd763ab95d2e74ff74edc51f8ae821aacae992a10704

  • Size

    366KB

  • Sample

    220520-2vn3qabafj

  • MD5

    20072b66f4ddde3d15294f1090667734

  • SHA1

    d6c3ff355c205774c646e2cac9e8d5bb96465fb9

  • SHA256

    e2b982e6aed9e786f3ffdd763ab95d2e74ff74edc51f8ae821aacae992a10704

  • SHA512

    54fcf1396b9ea666116899a7d7f1a4390343ec326ace09118403654e8347f838c367812f933bfeb94e5dbd16e879f2811690788a3a8733e646298504bca39b40

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ikechukwu112

Targets

    • Target

      shipping Documents.exe

    • Size

      403KB

    • MD5

      3d8a257d88d5942edddd4f1da97a7cf7

    • SHA1

      2483926aa04c44dbcf262ad44b8965e510d7713e

    • SHA256

      edc0c4b6e59c6ace0fa712c35715fc2d9cb2b0167c175e515bd971b3a52e530b

    • SHA512

      51726baf4e75c0f2455f955a4db69fea963e580baa8dd169bb4c41120d542d04b3733a9fe27c7dca8f01c636fc16be44ca4cb1db3789b63fb9fb0956dd2a252c

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks