General

  • Target

    11f8436dc996dcbdee4994070df2f730e47dca58bb1ee83a3377b3728f24e921

  • Size

    429KB

  • Sample

    220521-bca52aegbk

  • MD5

    8960c2cc0f66e55b698a81917915c78a

  • SHA1

    481769d39fcdbec3f66bfa74a9e762532864bbce

  • SHA256

    11f8436dc996dcbdee4994070df2f730e47dca58bb1ee83a3377b3728f24e921

  • SHA512

    8d50c7744b65fcddd9891c664e14194bb520f3a8ea5cb704d98d2f02b94c229674fabb555266ed4052c8b7f1fa5a596a1c835df2ae4bdb0cec0964722d88dff6

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.desmaindian.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    vU}t$13*orkO

Targets

    • Target

      CTM-Cash Denominations.doc.exe

    • Size

      643KB

    • MD5

      c0a105e07006fa3eb26942a40f8b2eab

    • SHA1

      2634355758087d4e7074cb93509be79219399d8a

    • SHA256

      4cfa54b4b97d2f12a225b24eb37c89312976f77f48cfa5da3ecd8dcf4a21ec90

    • SHA512

      8831fb3f87b0b430e254f02908971413223999ccb155c88826a9a238f8b0c58cdf90bb38eddd1af7aa7c76a405e9e008c8a35023fe51b7bf0b0c84d4935a9ef8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks