General

  • Target

    7d9216d1682b03cbc334625141e2a512.bin

  • Size

    721KB

  • Sample

    230328-caldnaac2t

  • MD5

    e4e41ce9f45131c49973abbb1e0e0f6a

  • SHA1

    59990a5aacb2cdd2d140424c0fcfaeba19500cc3

  • SHA256

    af37f13c11ad1e8b810381cbbe5d4f854e19d305d54acfa6f5f2a4880b514bb9

  • SHA512

    6739f546fb483cc48f4ac70307fb09000452196e84599e80fb3d490d0994ab55a33cee8360c223b2e4cb0206cf21ab071c58586bcd5b6bcaaeb14babc18a187d

  • SSDEEP

    12288:9FzvjXSakg39Rzr6qspK3DJXRcPAH3fdaJCWoDOhlRupTZHKIwdb9XTUHsMjgE:9FzbXjNapKnoe31aJ/ThP99XTUHaE

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.user-tech.com
  • Port:
    587
  • Username:
    ordsupp@user-tech.com
  • Password:
    Asu$7531
  • Email To:
    ordsupp@user-tech.com

Targets

    • Target

      f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b.bin

    • Size

      802KB

    • MD5

      7d9216d1682b03cbc334625141e2a512

    • SHA1

      b516d984e819dc86eb94e96560f7999d01d0f8b0

    • SHA256

      f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b

    • SHA512

      4036cf37bd22fd98d24b7e65e456a920ee1458b649e6c7409a68634c8484b87ac4166330976b41620a1ca2c701e8b9919f168695b763da650792a0e37100da3a

    • SSDEEP

      12288:PUJB0O6JhZGsIpdg6AkkUNtzwjwnIGE22JbZRQRiB0iZnsn0p:ECDKs6AkkqRw8IhZR8isn0p

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks