General

  • Target

    Remittance slip.exe

  • Size

    372KB

  • Sample

    230706-qy359sbg55

  • MD5

    758f5c1f99738cc2a59a385ce63e9a21

  • SHA1

    22c825fcdc8c78a5f4339ae98754a423ba67a2a1

  • SHA256

    b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5

  • SHA512

    aca0e6800300b410a27dac7740981d5fa1711ca86c752855e0f23ad786931a2e92a507d3c57b880d8fbdbf947f7de58c80b1bb6d3dacb555abc28ca49ee2e491

  • SSDEEP

    6144:/Ya65Gb4fu5qu5/9vkkq4Bd1QO8E2qtDAQMynxwAC+wNkm3iiI9kcZXUgApaYIno:/YDGbgu5qu5/9UWUO8EfkQBxK+weiWRw

Malware Config

Targets

    • Target

      Remittance slip.exe

    • Size

      372KB

    • MD5

      758f5c1f99738cc2a59a385ce63e9a21

    • SHA1

      22c825fcdc8c78a5f4339ae98754a423ba67a2a1

    • SHA256

      b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5

    • SHA512

      aca0e6800300b410a27dac7740981d5fa1711ca86c752855e0f23ad786931a2e92a507d3c57b880d8fbdbf947f7de58c80b1bb6d3dacb555abc28ca49ee2e491

    • SSDEEP

      6144:/Ya65Gb4fu5qu5/9vkkq4Bd1QO8E2qtDAQMynxwAC+wNkm3iiI9kcZXUgApaYIno:/YDGbgu5qu5/9UWUO8EfkQBxK+weiWRw

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks