General

  • Target

    45d5cbb777a70025d8f32cb8de30bc0fd9bd81391bcd2e6b825ef1b18091b812

  • Size

    381KB

  • Sample

    220521-axla3aahf8

  • MD5

    e599f028a60cd463ccf230e60f756d92

  • SHA1

    dfdeea4ef92e72a73826738e9fb3a9e9ef869391

  • SHA256

    45d5cbb777a70025d8f32cb8de30bc0fd9bd81391bcd2e6b825ef1b18091b812

  • SHA512

    6b5fe669dde214fcf6da3d904cdbcb49458bea3f494076f05ae21bcf16b5adef2740beb31b5cde041ea8ba5ab526055502bce8b00b77dfd82fbca5447e67e5b5

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.epaindemgroup.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    }bf9e+EW5s$k

Targets

    • Target

      Quotation.exe

    • Size

      548KB

    • MD5

      9cf9dabcd4bc18a2fa81313277e8db8c

    • SHA1

      52cc52fc375a70b6c5fe5e44986ba14f0095434f

    • SHA256

      d1bd877b6b748426000286d808fd8a397869e91f2e400aa328a290363b57fa0b

    • SHA512

      95a17318bc22766f3687553d9275e714ffdfa89c54cab77581ad55a91d186e812b4e0b84228ae43c81e939ed9918484c87bd239c4de78a529cc4e47cae89732a

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks