General

  • Target

    0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5

  • Size

    359KB

  • Sample

    220521-ncrh8sgehl

  • MD5

    5d8a3b227f46c7c818a1a6d2ad8353a9

  • SHA1

    84f46f42e21249dfe248fb68773887d90bca070c

  • SHA256

    0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5

  • SHA512

    3df4b3ef52bb0c6e41907017cc93653561c0cb081c94c8f209cb61bbe4da0409915469aaea3ebad134160acbc255eb5a03bdef258dda7877e62d4d1f7bcf02e7

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.waltartosto.com
  • Port:
    587
  • Username:
    e.fasciani@waltartosto.com
  • Password:
    pZQhjl!9

Targets

    • Target

      dhl_doc7348255141.exe

    • Size

      422KB

    • MD5

      20e9fed94db568a0528021b9b86e146a

    • SHA1

      f1c5e739ba485e28fec47e11bd7ca9e3817d4b8b

    • SHA256

      aedee4f131eef738b19991d52758a3e5aa8b804a6763a9fd48b568f1351d5452

    • SHA512

      f403e12abd5cf17b7881ca440f149a236c94b91e25fe77f06844b829d72dc82c5e023c8e4a023edfb9b084ddd3fdc087ef55cc863989d8a92ac67966cbad5b0f

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks