General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.16422.654.exe

  • Size

    835KB

  • Sample

    221208-w52hxadf8t

  • MD5

    eca94049fb52ae5b3c06a42e5c57e7ba

  • SHA1

    9c886e9c7e829d2aa2581f12322a62edfb68b513

  • SHA256

    4dd83a9f2b7002a9e6e98ce6035a077e3f379722429211c87c2ced4e708c2473

  • SHA512

    faea351122767b05f462ed45bc3091fa2fea5937e3b2f95bfa9a4823f0837c3de1a1af20a0f5946032cac6a7a691f43ba60bd097cfa1432f2761c3be3ea22db4

  • SSDEEP

    12288:53+sVxv8DshqGPtdUAOYFUzghI1+5NGeKHJQLvtiAdj6pg4DUfGDNDAQNk:p8DsPl9LUzgH3GKLvIyj4vAfCqQN

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.cnseguros.hn
  • Port:
    587
  • Username:
    llozano@cnseguros.hn
  • Password:
    Rebecca2007

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.16422.654.exe

    • Size

      835KB

    • MD5

      eca94049fb52ae5b3c06a42e5c57e7ba

    • SHA1

      9c886e9c7e829d2aa2581f12322a62edfb68b513

    • SHA256

      4dd83a9f2b7002a9e6e98ce6035a077e3f379722429211c87c2ced4e708c2473

    • SHA512

      faea351122767b05f462ed45bc3091fa2fea5937e3b2f95bfa9a4823f0837c3de1a1af20a0f5946032cac6a7a691f43ba60bd097cfa1432f2761c3be3ea22db4

    • SSDEEP

      12288:53+sVxv8DshqGPtdUAOYFUzghI1+5NGeKHJQLvtiAdj6pg4DUfGDNDAQNk:p8DsPl9LUzgH3GKLvIyj4vAfCqQN

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks