General

  • Target

    4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315.exe

  • Size

    1.1MB

  • Sample

    221207-qbhk2sab3s

  • MD5

    57bbed4a1aafc1b18b57fd359e2a2109

  • SHA1

    770f6b6a2af7005dc56e6e4afa0beb074de0d245

  • SHA256

    4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315

  • SHA512

    5feeb92d33b694fda800637fd97598a472c3a780f1d71851720cf7cfe99c9e5b517b7f366ed63958fc2e9042e741fdd03fd0f92cf5575a7b1b38c6f0a0500100

  • SSDEEP

    24576:+zR2gh/awpCqT1DmwZf9Xirkh/b3s5NR/jkVoMCZ+d5Hu2Dz:+zR5h/dP3f50k0R7yCZ+d5J

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    $bSl(ZB5

Targets

    • Target

      4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315.exe

    • Size

      1.1MB

    • MD5

      57bbed4a1aafc1b18b57fd359e2a2109

    • SHA1

      770f6b6a2af7005dc56e6e4afa0beb074de0d245

    • SHA256

      4195c8096bb885184910cd6a0bea55a153a80de55df2e147ec9c52f13a1db315

    • SHA512

      5feeb92d33b694fda800637fd97598a472c3a780f1d71851720cf7cfe99c9e5b517b7f366ed63958fc2e9042e741fdd03fd0f92cf5575a7b1b38c6f0a0500100

    • SSDEEP

      24576:+zR2gh/awpCqT1DmwZf9Xirkh/b3s5NR/jkVoMCZ+d5Hu2Dz:+zR5h/dP3f50k0R7yCZ+d5J

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks