General

  • Target

    7c13903ec26ae07d8ee41505b9e51fa77d0b2c8958fb72bd3ec3093093a9a6cf

  • Size

    354KB

  • Sample

    220521-akmncsadb6

  • MD5

    9f812e627940a3f2da9d522abdfb6753

  • SHA1

    2c4d422adfe1ed6a8f15a97f6371f4f8d7672eff

  • SHA256

    7c13903ec26ae07d8ee41505b9e51fa77d0b2c8958fb72bd3ec3093093a9a6cf

  • SHA512

    c355b82c69817def07b5fc4802fb49fee514ed6afff8c22265cfcd28623f3d8a255c09065d0851212c4534b928ff70ecc4e6eb13bf46360c3869a330027a0ee2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.lasauceda.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    sauceda2018Mx

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.lasauceda.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    sauceda2018Mx

Targets

    • Target

      169287394-75414-SANWVDDNETP0034-3.pdf.exe

    • Size

      513KB

    • MD5

      013b621a587c54486919ea4a2e448df4

    • SHA1

      470a66a9913a9db4923c0b1d6013378c515a0c66

    • SHA256

      acb0ce9651be7099082733999b4f29df902a494d9679c4a6352cac88ec5d0887

    • SHA512

      5858e08baaaa847c2c25f2a1c58b9b4e759f5f6e139c9e25dba92cb0f47c90e35f88ab07bb32c44caa1e90756b74ee79a8799787f9c2b16c7f1a3390682af515

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks