General

  • Target

    fef330d48bed61c5c87bbce7eb9124c4e46b9fa8b5a070ae1f2dd1d061bb16e0

  • Size

    465KB

  • Sample

    220520-3g6ahsbghm

  • MD5

    d05723e63bc0199a3fc8484ce38e082a

  • SHA1

    c84813f4222f199c0749d8883d4ba11760f997c7

  • SHA256

    fef330d48bed61c5c87bbce7eb9124c4e46b9fa8b5a070ae1f2dd1d061bb16e0

  • SHA512

    067700760d9ebe6f51221d298afd21f9cb4e890c7494a575befde6d0f13d5034dbaff563e6a94009b1e2709fa1defc1ea645b4e6eff2cf2d6fb7ee0450bc2677

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    afoerinwa123456789

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    afoerinwa123456789

Targets

    • Target

      inquiry.exe

    • Size

      581KB

    • MD5

      9f37c7f11d9c082bf73b0fb2b62f061c

    • SHA1

      59e9098505cfb5dd7f5973526801bff99b530d0e

    • SHA256

      4b38bf714e41ae836367e3ececa5762c8e03e276eead27d05dee39e5ef298503

    • SHA512

      e85384c68047bc85fed331635dca72711ecc0b46d21e6990282b58457ffa3544dc8077bd267e6804ad8cbb0c3d3350379cfcf891cce213da9960e8db4e3b39f9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks