General

  • Target

    16ba1ac62713b339860906be9a645724641f8c55dc9743f230632f107b694162

  • Size

    272KB

  • Sample

    220521-pbp5fsabgj

  • MD5

    11db2c5db12047d39a21673ed9247072

  • SHA1

    5d3a8fb6b1c6597369e6c0d13f4db67526c1507b

  • SHA256

    16ba1ac62713b339860906be9a645724641f8c55dc9743f230632f107b694162

  • SHA512

    c5bcae719cca75a348ce249e16a4939f2aa0953a691a7c87e6f102481ff1921878f10d86e61abc351d5e830e98a9a49b14ae186696a1a82f7d4373fa60d2a873

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    sales2u-kcom.com@yandex.com
  • Password:
    ALIbaba123

Targets

    • Target

      PI 20-S880320V8.exe

    • Size

      537KB

    • MD5

      93879252b2e0f720315a2bf4b7d8aaf8

    • SHA1

      7e281dd379a36d75243d4a4770061bac73f658de

    • SHA256

      6f881ac62ccc9fa3075114b64de262ef896ef9e14b4040e659fe7a362fe13362

    • SHA512

      9a03cbcae187a6b4a10585cfd1602ee57e50426a9cae248157f5c1c79267b0d1c089f847fc53d8cbf7273f9095f245b7c25a2db8b9361e2bc82aff2774cea929

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks