General

  • Target

    men.exe

  • Size

    894KB

  • Sample

    220522-gaf66agbc3

  • MD5

    45edc34840d4064a30068fbce08d3216

  • SHA1

    3c285e23a2857853dfd5e71e04819f858c51f2d2

  • SHA256

    fca9c0410b06e1f10b9f1cab03993f58d9f422a4fdf77688a60d87a175738726

  • SHA512

    fb455f8c02d477c596abe666dcf4b5db139c462107643d305dce225a4f410e8089d87688d32d8c5a6f18aca1b5c830c5e36230be57360b2f34e7f43c1e25a3fa

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.amalgama-com.gq/
  • Port:
    21
  • Username:
    yes@amalgama-com.gq
  • Password:
    s,Xz}jSn6~i.

Targets

    • Target

      men.exe

    • Size

      894KB

    • MD5

      45edc34840d4064a30068fbce08d3216

    • SHA1

      3c285e23a2857853dfd5e71e04819f858c51f2d2

    • SHA256

      fca9c0410b06e1f10b9f1cab03993f58d9f422a4fdf77688a60d87a175738726

    • SHA512

      fb455f8c02d477c596abe666dcf4b5db139c462107643d305dce225a4f410e8089d87688d32d8c5a6f18aca1b5c830c5e36230be57360b2f34e7f43c1e25a3fa

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks