General

  • Target

    bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6

  • Size

    546KB

  • Sample

    220521-ps4n6sbbfq

  • MD5

    d67be7ac02cd0e98246a3db5f3cc0ef5

  • SHA1

    96c4f90363162f2264be724bf53fb91d4be45a4e

  • SHA256

    bee324db8d9a75f757361aa1b684802ccbfe17b0f98a81d9ab394542d70545d6

  • SHA512

    6503e806579c87aac4a8a9e9aa2bb1ea9464c5ccf9956e6cd3c7c438599b5dd3cb6d78a9d1c77ca75b438d6fad00d21cfef7b6ce6fa75b54999609e30abab9c8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kingmoney12345

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    kingmoney12345

Targets

    • Target

      payment slip ..exe

    • Size

      580KB

    • MD5

      9b47246feeea57e036332ce0a59fe316

    • SHA1

      6ff968f1287b499926518605d1d4e3405a5d577e

    • SHA256

      40f62edaaf245e669c4c4de028657d8762862124d810e9f71184e0dc5ca23df2

    • SHA512

      ab95804b3f67590a4edb3a926a8832a3036e48092ca01c3b7def4e2111b481ea6257240dbc08ef5cb4bc84650a784f3a2f09ac66f5033dd5d4ed400d9be10e44

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks