General

  • Target

    0c4adf8627fd761e687d134f95d6110a56e8221abe67d9007866f4c1c7a4b2c8

  • Size

    383KB

  • Sample

    220520-2zaqwsbcam

  • MD5

    e59406cd43db5001c87fd4a580354eb9

  • SHA1

    6476b487ae9c588a02f3acacb94beef0065a08e2

  • SHA256

    0c4adf8627fd761e687d134f95d6110a56e8221abe67d9007866f4c1c7a4b2c8

  • SHA512

    1679d655ad60bcff33427c05c60d63fa286b3becb11a66ec60bb4ee2933dc512d1127555e7b1f31f960fe3114d5b3081c8fc01c2ed6fb237ecbcf55643d87e54

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    terminal6.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    D5%&cLkPJ{rW

Targets

    • Target

      0c4adf8627fd761e687d134f95d6110a56e8221abe67d9007866f4c1c7a4b2c8

    • Size

      383KB

    • MD5

      e59406cd43db5001c87fd4a580354eb9

    • SHA1

      6476b487ae9c588a02f3acacb94beef0065a08e2

    • SHA256

      0c4adf8627fd761e687d134f95d6110a56e8221abe67d9007866f4c1c7a4b2c8

    • SHA512

      1679d655ad60bcff33427c05c60d63fa286b3becb11a66ec60bb4ee2933dc512d1127555e7b1f31f960fe3114d5b3081c8fc01c2ed6fb237ecbcf55643d87e54

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks