General

  • Target

    e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7

  • Size

    320KB

  • Sample

    220521-xkgtfabhf3

  • MD5

    4ca72cdf95f603248189bee49f9291d5

  • SHA1

    5743ae6c2f3bda1b139db68109ba0a146c908763

  • SHA256

    e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7

  • SHA512

    a567c844c58f675284565bed7ed726b803b0ab5756d25b3477331fa31cbea4fe192f2e48dcffc43d99d6e3710e5bf93b4e810b220ef5e0c68677b8b291944e23

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Igboamaka1

Targets

    • Target

      RFQ..exe

    • Size

      363KB

    • MD5

      976be92376c72a2c0c4927d2f0a13651

    • SHA1

      c6b4a69ebd63382be533a9e2e4dc7c51e5c852d1

    • SHA256

      d7bd54e41dbe29893e23fef937a9579c238abaf34196fb8905c3313192ed2393

    • SHA512

      eb8bfcb357648cebf8116b744b064dfa05de0c97f8d5a38d24150a21792ef5e7de3d24133af97346fb66b4f58be423d21e5e868a7de8eafe14f345be3de3fd42

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks