General

  • Target

    MT103 USD36k_pdf.exe

  • Size

    300KB

  • Sample

    221128-kl1xgsae35

  • MD5

    67060e229fd001baaf2ff8e36f435f0f

  • SHA1

    e8fa3767b8cc7df3c58e04ffb77ba49ca0d65210

  • SHA256

    3715a1b3671a7526ba34a708a617c353c27380d255b6a74493978ded978e01b0

  • SHA512

    38ea3c2ed47ae45062b6239c1812616479fefe957f93b60281431d5aff6272fa7948b0bc77149ae2195ccf2abb2171e99731d68e06bf990ebbb9aa18a49c5086

  • SSDEEP

    6144:BBnvBRhD9wLIp/s6usl9aAh3RhB0QbsIABuwVeWK:35aes6ft3Rhp7ABuwVe7

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      MT103 USD36k_pdf.exe

    • Size

      300KB

    • MD5

      67060e229fd001baaf2ff8e36f435f0f

    • SHA1

      e8fa3767b8cc7df3c58e04ffb77ba49ca0d65210

    • SHA256

      3715a1b3671a7526ba34a708a617c353c27380d255b6a74493978ded978e01b0

    • SHA512

      38ea3c2ed47ae45062b6239c1812616479fefe957f93b60281431d5aff6272fa7948b0bc77149ae2195ccf2abb2171e99731d68e06bf990ebbb9aa18a49c5086

    • SSDEEP

      6144:BBnvBRhD9wLIp/s6usl9aAh3RhB0QbsIABuwVeWK:35aes6ft3Rhp7ABuwVe7

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks