General

  • Target

    transferencia de pago_pdf.exe

  • Size

    799KB

  • Sample

    221001-qkg1wahagm

  • MD5

    00e78eaae97ed8ed417f77889fd1d231

  • SHA1

    402044f3fe83b5a8d46592623b28f4a12c549750

  • SHA256

    54e93af542ac3ef569b83e4c877e278e95bd1e9bc7cf48335975c42f7729fcd5

  • SHA512

    1f2c0980b3a852e6949c23a205942a97b61e7700e98dc5a392fd5195f8a3f62d57ae18d5588597094e903059ca2bcbbf580ae08b21511365407e7fa0d9719562

  • SSDEEP

    12288:pA12iNwwg3vloawk0WkV/oxlWaFTnBLIXGybuIRZMXXuqB85JUsvA:u1PcmaYWSgxl9IbNfMXeqYxv

Malware Config

Targets

    • Target

      transferencia de pago_pdf.exe

    • Size

      799KB

    • MD5

      00e78eaae97ed8ed417f77889fd1d231

    • SHA1

      402044f3fe83b5a8d46592623b28f4a12c549750

    • SHA256

      54e93af542ac3ef569b83e4c877e278e95bd1e9bc7cf48335975c42f7729fcd5

    • SHA512

      1f2c0980b3a852e6949c23a205942a97b61e7700e98dc5a392fd5195f8a3f62d57ae18d5588597094e903059ca2bcbbf580ae08b21511365407e7fa0d9719562

    • SSDEEP

      12288:pA12iNwwg3vloawk0WkV/oxlWaFTnBLIXGybuIRZMXXuqB85JUsvA:u1PcmaYWSgxl9IbNfMXeqYxv

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks