General

  • Target

    e8c8d7a50c03e8fa16f02d1ef15d1f143cbeb182962153d9fe89cf0a4c4a5126

  • Size

    655KB

  • Sample

    231201-p7h11saa4w

  • MD5

    4beb5f37d47545f41bfa16188b6c7c33

  • SHA1

    9ce5f0b1c56d091b9069331bc187a1e42016eb45

  • SHA256

    e8c8d7a50c03e8fa16f02d1ef15d1f143cbeb182962153d9fe89cf0a4c4a5126

  • SHA512

    579cf78d69d93b682b1d3f4af23f1de7428cafde0f5574c431f85bfc0ef028bc09653d6d4a5e59b394c5ebcacbba713cbfb4edd0939b97af7441106b656b1dd1

  • SSDEEP

    12288:wwHmRh9s8AAUFAk0MxAIxKf68e3L2C19YRRmBEfbeUvW5YDf50en+EDI:xehS8AAcfuIxKy8ALJbYPCE25ch0en+p

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.experthvac.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    -8{jszMOY*Z8(~Za0#jyP%o7VoB.0)kk^)7_

Targets

    • Target

      New_Order.exe

    • Size

      823KB

    • MD5

      3713c253ab56bf85aaa806fc41cc6905

    • SHA1

      cf59aac87590bb5f3bba092f20455b097a1ffab5

    • SHA256

      ae52ee94e65fb54e279703124ab5ee6191f655f61c5302c49e4cd862cfd1dc17

    • SHA512

      ca02a48ec0ff561e50817d661830cd4c4cf39fdc9e458a8fc93170d0fbafc6d1c5f6903a888b95c313e639c74e1e2c2369486873a14fcfbafaa58c7313230f87

    • SSDEEP

      24576:GSqnsJhQ8AA6vkIx4W8AHPb41CEjSd8n:JqnsPx6vQA7USun

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks