General

  • Target

    b76db9b5dd76ceb0dc9ce6c697ca4083a1ddb2d618b661a27c21748c422fe56f

  • Size

    546KB

  • Sample

    220521-ptf99sgaa7

  • MD5

    30cceb11385dccf47158fb942e5c71dc

  • SHA1

    3cb87422cd66bfe80a4ae9bf54498160728d9c1c

  • SHA256

    b76db9b5dd76ceb0dc9ce6c697ca4083a1ddb2d618b661a27c21748c422fe56f

  • SHA512

    6f81e34a1e243f46c67fb6ec7d23b8441402e4f984aad14d5d6068c4aebc3dccd4097eac6b938870b4ce26a633e31d86f318283edbb9b53ba82a673efa5e62ea

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    daily@is-ceo.com
  • Password:
    63075OFF!

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    daily@is-ceo.com
  • Password:
    63075OFF!

Targets

    • Target

      Remittance Copy.pif

    • Size

      789KB

    • MD5

      c9c5b92936bc5eba4ef381d0d815bef3

    • SHA1

      6be466bd73ca5be4bdebbf059e799db20f105211

    • SHA256

      656e99ec9ba18c70b338604ef390ce523a35339c8bc556ff2963ca2ce87baec7

    • SHA512

      0fccc574106ff99ec695e61e74502003c30e296ae9ad4904e30c27f45e5435c67fc8ea20059f74db0282fb8d243468bf4b5f6e9c6d66b39f5a89453f422ae258

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks