e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7

General
Target

e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7

Size

320KB

Sample

220521-xkgtfabhf3

Score
10 /10
MD5

4ca72cdf95f603248189bee49f9291d5

SHA1

5743ae6c2f3bda1b139db68109ba0a146c908763

SHA256

e441fb72d808b10356c773a2229a64d26af0b7bf76bce3fc575e01d73eadf4b7

SHA512

a567c844c58f675284565bed7ed726b803b0ab5756d25b3477331fa31cbea4fe192f2e48dcffc43d99d6e3710e5bf93b4e810b220ef5e0c68677b8b291944e23

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.privateemail.com

Port: 587

Username: jinghao20@jinghao.pw

Password: Igboamaka1

Targets
Target

RFQ..exe

MD5

976be92376c72a2c0c4927d2f0a13651

Filesize

363KB

Score
10/10
SHA1

c6b4a69ebd63382be533a9e2e4dc7c51e5c852d1

SHA256

d7bd54e41dbe29893e23fef937a9579c238abaf34196fb8905c3313192ed2393

SHA512

eb8bfcb357648cebf8116b744b064dfa05de0c97f8d5a38d24150a21792ef5e7de3d24133af97346fb66b4f58be423d21e5e868a7de8eafe14f345be3de3fd42

Tags

Signatures

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Description

    Tries to access configuration files associated with programs like FileZilla.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles

    Tags

    TTPs

    Email Collection
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Tasks