General

  • Target

    e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871bexe.exe

  • Size

    854KB

  • Sample

    231207-x8bbkaga91

  • MD5

    f1c29a78359e767adbd42221ba8b7b56

  • SHA1

    4e58abe556bb71a5596fb9e5b098028e8acdce69

  • SHA256

    e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871b

  • SHA512

    e16e6a7ea1a78a5fdcd592a7bb7206c297114b342dc53a789eed32989de4347ea8445920099eb065fdd151aabce42715590c0f872f211875cbeaad837f360b8f

  • SSDEEP

    12288:ZCueH5qPLOZRIiD013VVAcXVhRzozvIjfOcr7UVIZg4+K:oqPqZRjD2foATV3UeOFK

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sarahfoils.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Scalatica01

Targets

    • Target

      e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871bexe.exe

    • Size

      854KB

    • MD5

      f1c29a78359e767adbd42221ba8b7b56

    • SHA1

      4e58abe556bb71a5596fb9e5b098028e8acdce69

    • SHA256

      e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871b

    • SHA512

      e16e6a7ea1a78a5fdcd592a7bb7206c297114b342dc53a789eed32989de4347ea8445920099eb065fdd151aabce42715590c0f872f211875cbeaad837f360b8f

    • SSDEEP

      12288:ZCueH5qPLOZRIiD013VVAcXVhRzozvIjfOcr7UVIZg4+K:oqPqZRjD2foATV3UeOFK

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks