General

  • Target

    b11a0bce757f636b17b031043666ec08956175dfdea6f7402ed136852d9b618d

  • Size

    401KB

  • Sample

    220521-pgmaraaebn

  • MD5

    f8c5e99f6c4b862d7d9407661fe44f5e

  • SHA1

    f5836d64a9d67af4c21a4342a53480447c007bf3

  • SHA256

    b11a0bce757f636b17b031043666ec08956175dfdea6f7402ed136852d9b618d

  • SHA512

    97ebe31f1bb16af54f583afd14da0a8ccf91cfdea0a9b8c84ffa78b68ba5671a734ad5e99f96db37edf8b4a5262227c26d7f86e13d1eaa96a0de2e976d72648c

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    chinapeace@yandex.com
  • Password:
    chibuikelightwork1

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    chinapeace@yandex.com
  • Password:
    chibuikelightwork1

Targets

    • Target

      invoice.pdf.exe

    • Size

      439KB

    • MD5

      8e8165e74a734ef4504df4fc4b014f8d

    • SHA1

      ce43b52541df7cdc3f4053d201517adb447005c9

    • SHA256

      f892f7e0b4bcfd9084ac791d72a87a95a16ca175a154faf0a2e24da5dd205bce

    • SHA512

      101124fe99affa3944d3fe225c1e3065548c2e0faff42dd58fcfbed295d91e41733a068e6a629aba91ad5c5258565cbd47f2f4544e10d8a418c7ae1edf5cb5f4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks