General

  • Target

    13d4b5daf8b330ea265b54b0b90028d8c3e67578336cc9557eefd962bb0f9eea

  • Size

    606KB

  • Sample

    231208-mjvnssbh81

  • MD5

    edd0358919d734212a82093eae9f65a4

  • SHA1

    3a4f4aa36c4da0b39a8fd048a580db56cc05bffb

  • SHA256

    13d4b5daf8b330ea265b54b0b90028d8c3e67578336cc9557eefd962bb0f9eea

  • SHA512

    f846f1a28582ff72826a7f0c78e01e0f4d5329a2b62fc2fd7141382db50572131eef18631d2d019bddfd451e01c759b9c25cb33525c74afd69ef333f35b67ed1

  • SSDEEP

    12288:Br3+dDulM3BxlSKTGS63AojAG9WReFaquu8TMWA5:BuK2xxbmwojAuUCBuplO

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.wcoil.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Largoo11!

Targets

    • Target

      PO_INV Payment.exe

    • Size

      833KB

    • MD5

      1680c36ba32de652263ecbea2da37f3e

    • SHA1

      d94d86320691dd007d88d4c7c3a4000d6f785ab2

    • SHA256

      c93bde97c40ef62ed29d1ac5ff077603c11a043ff8ae58fd854333a2c8e37c2d

    • SHA512

      22d06e5a00d9063909b987e1549e5848fc47e4811eebe72765972404f0bb9adf029ce2b5e674903d2b762d119566352237bca3bd7e8f142b32cbfd3de5157a80

    • SSDEEP

      12288:Q5x1wCDwhjBiRynxZxn+SoSgYCiWCzY8wHU83Cfl/5KSDPr5uCdef:GoIRaZF+SobYv/R83y/5LDMCdef

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks