General

  • Target

    Quantity breakdown.exe

  • Size

    1.0MB

  • Sample

    230327-xt58dseh52

  • MD5

    5c9c5ff4c2b459caa1c17d77a0780404

  • SHA1

    3837ed0d13c37d1edf4c8ef45ac77a9528af35f2

  • SHA256

    02e4cc9a5bd09bafa5384bdf00f60f7b8bc31f7314466150d137da53a260e46c

  • SHA512

    32705264c13396daca41057f665ba071ebabe346f9514a0b1d04f8e96c51e3e245cdc9f261bcd7a1223970772103f05a99d72950d8932ea61a33f21cdcfc45ca

  • SSDEEP

    24576:G5U6hLdFCrvq3B/sI3wOzitPFrEYcWKB5LdFGLdFmD41:mTfFCjqJ3wOziplmZ1FuF44

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    ghostboylog@saonline.xyz
  • Password:
    7213575aceACE@#$
  • Email To:
    ghostboy@saonline.xyz

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    ghostboylog@saonline.xyz
  • Password:
    7213575aceACE@#$

Targets

    • Target

      Quantity breakdown.exe

    • Size

      1.0MB

    • MD5

      5c9c5ff4c2b459caa1c17d77a0780404

    • SHA1

      3837ed0d13c37d1edf4c8ef45ac77a9528af35f2

    • SHA256

      02e4cc9a5bd09bafa5384bdf00f60f7b8bc31f7314466150d137da53a260e46c

    • SHA512

      32705264c13396daca41057f665ba071ebabe346f9514a0b1d04f8e96c51e3e245cdc9f261bcd7a1223970772103f05a99d72950d8932ea61a33f21cdcfc45ca

    • SSDEEP

      24576:G5U6hLdFCrvq3B/sI3wOzitPFrEYcWKB5LdFGLdFmD41:mTfFCjqJ3wOziplmZ1FuF44

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks