General

  • Target

    IMG-20220926-WA0000000008....exe

  • Size

    882KB

  • Sample

    221001-k3a3dsfgc6

  • MD5

    a5e9194aebaee807a27b58dcc1a9b000

  • SHA1

    94932b210e64a2349f6e824631dcc8298e719e09

  • SHA256

    c7e5612eca504249bfde7ecc7bcdb3bb2220e9f0599aa675b6acd939d29e47bb

  • SHA512

    a9df6bf6dc98d11d89b31d353a7dda6db76906940b2b181961a42fa5f57b1d560e297f4d737bb80f18b43e5d41e8017379ed9acfda4835a5fd80af9e0e945d2c

  • SSDEEP

    12288:V7C+LVFcxr4tlKD9xK4oIl5j0Ne6Oz2NUMfyTiADqjJ5nu9H:BCWVF77WvXoIfoU6KMf7jrk

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.toala.com.mx
  • Port:
    587
  • Username:
    ventas@toala.com.mx
  • Password:
    oceano2012
  • Email To:
    nolimitforce@yandex.com

Targets

    • Target

      IMG-20220926-WA0000000008....exe

    • Size

      882KB

    • MD5

      a5e9194aebaee807a27b58dcc1a9b000

    • SHA1

      94932b210e64a2349f6e824631dcc8298e719e09

    • SHA256

      c7e5612eca504249bfde7ecc7bcdb3bb2220e9f0599aa675b6acd939d29e47bb

    • SHA512

      a9df6bf6dc98d11d89b31d353a7dda6db76906940b2b181961a42fa5f57b1d560e297f4d737bb80f18b43e5d41e8017379ed9acfda4835a5fd80af9e0e945d2c

    • SSDEEP

      12288:V7C+LVFcxr4tlKD9xK4oIl5j0Ne6Oz2NUMfyTiADqjJ5nu9H:BCWVF77WvXoIfoU6KMf7jrk

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks