General

  • Target

    24db22b40b01af7bab207d09b7cd430a5892d646ed6291e416643e546d86ced4

  • Size

    410KB

  • Sample

    220521-bb2atsbff3

  • MD5

    20a058d7813d4247191dd5c80a53043b

  • SHA1

    ebc05e1fb6d6c192bc5c61272c2ce375501c22cc

  • SHA256

    24db22b40b01af7bab207d09b7cd430a5892d646ed6291e416643e546d86ced4

  • SHA512

    e079ff75a4dd8d344e1a089961d5f7dbb08dbda5d32bd88f04cad9da5b537e061e5aa9a8587bd2583456b2666bc9229b6dd78e4715e7117dec54aaad8dd23863

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.desmaindian.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    vU}t$13*orkO

Targets

    • Target

      MV Christos Theo.doc.exe

    • Size

      609KB

    • MD5

      5083d040d295c0c2ced9dc9178f45b47

    • SHA1

      edd06606b96206ff82845786ee298c3a05cc8a4f

    • SHA256

      c50ba6556752607323e0e14d5429961d9af3804d9b45f8c7755ec1709efc6af3

    • SHA512

      efdc814bad5379526914c51ec17d3acfc37eca1cf47545c7fe8d589a44a1ecd426d97638570d03bdcedb8351d8fe7cb3e5f2faa87aeeb7a6332db6af3318331b

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks