General

  • Target

    4d0652cfea0c59cba719fe83663ba43b439906deab66121d2b0fb0c02a468643

  • Size

    440KB

  • Sample

    220521-n8h7qsaabj

  • MD5

    6596142e309e18b6409bb4546e4fcea6

  • SHA1

    4e2384038e9c7c5f23c3e42fda96c011897c5497

  • SHA256

    4d0652cfea0c59cba719fe83663ba43b439906deab66121d2b0fb0c02a468643

  • SHA512

    f9f99b140628dad74fbb7c860c10d56c5a3930e151f2e684d8768d35cc94802bd68e4df3245cb2199ae830bb5551a405380eebf49293d1d00a09d10b0e87f0bf

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    result.package@yandex.ru
  • Password:
    Blessing123

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    result.package@yandex.ru
  • Password:
    Blessing123

Targets

    • Target

      Payment _Copy.exe

    • Size

      459KB

    • MD5

      183d4f4ea6559f8192b9909dd3b0160c

    • SHA1

      2cd600462508fa3ffe00463d803d2fb5009db88c

    • SHA256

      d6966bdc03399a2691eeba985de79e0a35558b9a40d7e10ea149e06c0508c108

    • SHA512

      ff1667348eab4f2cc65a951b3f6746d2f511c99959b8348cafedb2e455833d2ef33e27870321999e0c87e341ea843f099717ba43ac68ada6f770cd21e9646056

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks