General

  • Target

    d22e28bb45ca0e28dd3022916c14f5198764c9d89891e28a8fe57c08ab3ec632

  • Size

    411KB

  • Sample

    220520-3bmafsbefj

  • MD5

    344a85272fe992b15344b20a9ea2f0b5

  • SHA1

    b31d19f7e8fc871664c319ece96c18b06d6bf1a1

  • SHA256

    d22e28bb45ca0e28dd3022916c14f5198764c9d89891e28a8fe57c08ab3ec632

  • SHA512

    ada309d2c3c64f9b8cea23ee147562f9df2a20acb2a0b30539eb3ff06aee5c101a6f9d7084cfa2e4dbf7b8ade3dc4c80877ec7855ff65db124703cbc91dde2ce

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.fratellidelpiano.com/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    playboy123#

  • Protocol:
    ftp
  • Host:
    ftp://ftp.fratellidelpiano.com/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    playboy123#

Targets

    • Target

      Prova di pagamento 08-06-2020.exe

    • Size

      479KB

    • MD5

      2fb77515a6a9dbbaa2d58745e304e8e5

    • SHA1

      9c54622f054d334d6fe6f2319816dfaedb51f909

    • SHA256

      1c34317a5796aab26b69fb848d1c79bf97801d1d0286fda330819f4e6f57932b

    • SHA512

      7bd0a3db804a81fcd2aab21dd9f665ee05d70801607a41e45be11b60a4e64a0cddd225c04fefcde9fbf548f2bf6b2461145f4671a1e849a338bb269caa0411d0

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks