General

  • Target

    51bf73d20e01e9c502f31708c546ab2a661e23fef4964b94eb1b630074e0acf4

  • Size

    844KB

  • Sample

    220717-s1njpsedel

  • MD5

    e3b0ec5a277f6083bcf0eef4327579f2

  • SHA1

    80dcc45ba3b176b57e340854dbcbf71212138220

  • SHA256

    51bf73d20e01e9c502f31708c546ab2a661e23fef4964b94eb1b630074e0acf4

  • SHA512

    37b83f8d4e9fb97186bdc79a18001f2c2364dbdec670805ed12d771ddc54e660923d3e2918d112627bb236d06de2a34e16a76a0612b84575fdd31443893411c1

Malware Config

Targets

    • Target

      51bf73d20e01e9c502f31708c546ab2a661e23fef4964b94eb1b630074e0acf4

    • Size

      844KB

    • MD5

      e3b0ec5a277f6083bcf0eef4327579f2

    • SHA1

      80dcc45ba3b176b57e340854dbcbf71212138220

    • SHA256

      51bf73d20e01e9c502f31708c546ab2a661e23fef4964b94eb1b630074e0acf4

    • SHA512

      37b83f8d4e9fb97186bdc79a18001f2c2364dbdec670805ed12d771ddc54e660923d3e2918d112627bb236d06de2a34e16a76a0612b84575fdd31443893411c1

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks