General

  • Target

    AvEQnWGwPb43iCj.exe

  • Size

    1.3MB

  • Sample

    220930-zpvxzaegg5

  • MD5

    771559a28a51936053a811c912b26b39

  • SHA1

    a6e9444dfbe540e332a07edae3db9bdca167b41b

  • SHA256

    92b26f5c64684db2b440654c2efad6990005157394c0a2a3d60b556499e2bdcb

  • SHA512

    d1c82cc08640865d7702a714bcceffa601a24915b9dd6517aaa2fb5a5c3dcb193f27ad6859e2a505f5c6071cf6d04cee9a4d079c46796c344bd5031670e3531b

  • SSDEEP

    24576:tSPXe1vGMY3NMDKV1Wyk0xMCkmti2lIAhJ:tS25GcKV1T12lOil2

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.chinarcnd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    HS*PSwS9

Targets

    • Target

      AvEQnWGwPb43iCj.exe

    • Size

      1.3MB

    • MD5

      771559a28a51936053a811c912b26b39

    • SHA1

      a6e9444dfbe540e332a07edae3db9bdca167b41b

    • SHA256

      92b26f5c64684db2b440654c2efad6990005157394c0a2a3d60b556499e2bdcb

    • SHA512

      d1c82cc08640865d7702a714bcceffa601a24915b9dd6517aaa2fb5a5c3dcb193f27ad6859e2a505f5c6071cf6d04cee9a4d079c46796c344bd5031670e3531b

    • SSDEEP

      24576:tSPXe1vGMY3NMDKV1Wyk0xMCkmti2lIAhJ:tS25GcKV1T12lOil2

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks