General

  • Target

    de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a

  • Size

    602KB

  • Sample

    220521-ny5yraech7

  • MD5

    48c81f687a28b1c0c7077595496e2b62

  • SHA1

    b610711ca626022661c015237661e33670ac8098

  • SHA256

    de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a

  • SHA512

    a09b102869918a7bc3b0bd2f467b0626fc60ce462b8079fd8b222139dcfc79cb949a84a775f9ca65f182e2a31126cfaf790a7ff902f61a83b000dfca5f9da57f

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    sologlobal@yandex.com
  • Password:
    amblessed22

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    sologlobal@yandex.com
  • Password:
    amblessed22

Targets

    • Target

      Shipping Details 00459010265 - 07.07.2020.exe

    • Size

      719KB

    • MD5

      ec25c93cf619cf346cbb955af0518baf

    • SHA1

      6a72eb049453cc1aa268f424eb03fa4b466bcfea

    • SHA256

      ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec

    • SHA512

      52886dbab173286145b16e61a45051ca8a79bf94ed317e7f35047552c2ce47f51610f46e22b19b8dafa748f0c7c6974bbbd22e059ce28578810837540bb96df8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks