General

  • Target

    SWIFT.exe

  • Size

    921KB

  • Sample

    221208-lc2m4ahe54

  • MD5

    b5bc19319a968c7c0ed17754eba4f0bf

  • SHA1

    cf11eb80990f6925d6c8cb19547f32df129d7eea

  • SHA256

    f5c710060042d56e8e18e0d42256a4959c8d5529f8ea90e8e3084a742a9027f4

  • SHA512

    f5747b0cf342acae1bf87028fee711119a87b4ec03aeac68389ff6dca4fd8704ed12ad3a932016c82bd8743f7e5bc0440a8e115925e22cc59ca9b342b2ec0107

  • SSDEEP

    12288:E2IMOgHGPtdUArpY+ZmBjHUk+qj5DgL1RBVJuzZJv84gm786nazru/aK3o3DX:VIDgml9VhZmBHfg5iDvxPLnazrupk

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.ardsmmm.com
  • Port:
    587
  • Username:
    ebru@ardsmmm.com
  • Password:
    Ard2015**
  • Email To:
    agolfengr@gmail.com

Targets

    • Target

      SWIFT.exe

    • Size

      921KB

    • MD5

      b5bc19319a968c7c0ed17754eba4f0bf

    • SHA1

      cf11eb80990f6925d6c8cb19547f32df129d7eea

    • SHA256

      f5c710060042d56e8e18e0d42256a4959c8d5529f8ea90e8e3084a742a9027f4

    • SHA512

      f5747b0cf342acae1bf87028fee711119a87b4ec03aeac68389ff6dca4fd8704ed12ad3a932016c82bd8743f7e5bc0440a8e115925e22cc59ca9b342b2ec0107

    • SSDEEP

      12288:E2IMOgHGPtdUArpY+ZmBjHUk+qj5DgL1RBVJuzZJv84gm786nazru/aK3o3DX:VIDgml9VhZmBHfg5iDvxPLnazrupk

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks