General

  • Target

    1b31cc74b1ec37433f4c27c93b1f8f207f6d18d948f4163b786563065fa9064f

  • Size

    575KB

  • Sample

    220521-mzhn6sfhbl

  • MD5

    25de72927b827903b4374bb2a4ba987b

  • SHA1

    7bcde49cfefb5aaf0e524cf68f640d5a63b6bfe9

  • SHA256

    1b31cc74b1ec37433f4c27c93b1f8f207f6d18d948f4163b786563065fa9064f

  • SHA512

    3d613f6faf9b72cbfc86ee4bdd8426affd147d3419bc6ab1b987765c5972e407ce88e1fea9b93a238c7d17628f7cce2e88c34d3bb1e22d307f36fc3627a73d2e

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    zip-creations.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Zip2019gabyka

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    zip-creations.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Zip2019gabyka

Targets

    • Target

      Fr-200000346.exe

    • Size

      862KB

    • MD5

      f9781e73cb3e98a87a3e2c05f2a4fb48

    • SHA1

      4f74a3109f299e329827e8b9bc1ac2fd4cd900ea

    • SHA256

      50294179f00f6e7f94257183a8680c08f4d4dbf4639831e68b02757c361eaf34

    • SHA512

      5826578fe664f7650c4c000e655ab2431a2cdbe0c70555912cbe4b59c69be6bbc049c7d38e210df55439c82a5db955f7519860e8928e6989cb14c8592dcc75e3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks