General

  • Target

    0faf2b13bf2287d0c8191f879abc20374497d891

  • Size

    703KB

  • Sample

    230111-p8r1bagd2v

  • MD5

    f34a371fbc755d99e600c88580b1a125

  • SHA1

    0faf2b13bf2287d0c8191f879abc20374497d891

  • SHA256

    874f3c445ed43153d3b4961a98ccba831952fa444403f3abda19e393b9b35ebb

  • SHA512

    053679d5a51202003b3ce1bc9a4c222462741bdb65f2d5703960b61da9e429cdbc58b25933ad7b000b3cf0022a93e348d813eae20c9ae05e55547c318f54bc4f

  • SSDEEP

    12288:4YVbEb1Sh4PQs27x4ry81mUM5zlbv2kuRaAscBJGG1wa:4YVbuA+PQjxkxy5hbvzuRaARBf13

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sseximclearing.com
  • Port:
    587
  • Username:
    saurav.roy@sseximclearing.com
  • Password:
    Ssxm@9854
  • Email To:
    davidsurly1@gmail.com

Targets

    • Target

      0faf2b13bf2287d0c8191f879abc20374497d891

    • Size

      703KB

    • MD5

      f34a371fbc755d99e600c88580b1a125

    • SHA1

      0faf2b13bf2287d0c8191f879abc20374497d891

    • SHA256

      874f3c445ed43153d3b4961a98ccba831952fa444403f3abda19e393b9b35ebb

    • SHA512

      053679d5a51202003b3ce1bc9a4c222462741bdb65f2d5703960b61da9e429cdbc58b25933ad7b000b3cf0022a93e348d813eae20c9ae05e55547c318f54bc4f

    • SSDEEP

      12288:4YVbEb1Sh4PQs27x4ry81mUM5zlbv2kuRaAscBJGG1wa:4YVbuA+PQjxkxy5hbvzuRaARBf13

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.