General

  • Target

    d690f7f5bf1bbdd8d93e7b9c10168c41aa56aa24943ef575bef57e4431014917

  • Size

    467KB

  • Sample

    220520-3qm6ashch6

  • MD5

    fc6fd0ecd6c9f0049c1f18fcf1d060ca

  • SHA1

    f4360efb4fa1814de7d68dfb10e48c97d8099cf1

  • SHA256

    d690f7f5bf1bbdd8d93e7b9c10168c41aa56aa24943ef575bef57e4431014917

  • SHA512

    21cf680ffad010b0b0862a60c58b5af8e7ff9b959b502cd5ff90a08d7da1b68fc520bea9bbdbc6090ea4c3addd2c41c90822aeff139e1f889e3fd1271b4c25da

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.avastragroup.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    *vVABUb9

Targets

    • Target

      Order,.exe

    • Size

      583KB

    • MD5

      5392f7f768f5fc8286838eef12e8c8fd

    • SHA1

      914eae4f7bec91dc0be0139ebdea6c2afe8f158e

    • SHA256

      8a1f4224e9610baf4b264696b5955bfdeed335695da4b7f60233301c8928c5e9

    • SHA512

      30550ae02cbd987be6042c1c967d0953f72185adc2a717e49d4ccec4e86fb0b3c3f918558c4cb58369a067de38f592160009255b038e3516a9d384ac1e993643

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks