General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.103.32418.exe

  • Size

    896KB

  • Sample

    231208-vvvf6sbchk

  • MD5

    4d32a5c55202913c93b58d6bdde3ceed

  • SHA1

    cb1179bc185b78f9828a15b779ab65c345b5f370

  • SHA256

    d206e7098a885c65f0b56b34169d9599ce70c09d81439571e3d13f309305142a

  • SHA512

    2a5c952f0e505eef341f1e69cd5d2100ee05f6171330f22352be470350d77571a7ee511e4d48e127893ee03b01353d89b2a7f602ebb717d4c21411b2d5ed1755

  • SSDEEP

    12288:uid+fLgkaGPugBDKSWKGOoirbnhsGpkEukeg28dWkRqhP7ZwPrsx:cvaxkDKS3PrbhskkEuk284OKF0A

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    nne dimma080

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.103.32418.exe

    • Size

      896KB

    • MD5

      4d32a5c55202913c93b58d6bdde3ceed

    • SHA1

      cb1179bc185b78f9828a15b779ab65c345b5f370

    • SHA256

      d206e7098a885c65f0b56b34169d9599ce70c09d81439571e3d13f309305142a

    • SHA512

      2a5c952f0e505eef341f1e69cd5d2100ee05f6171330f22352be470350d77571a7ee511e4d48e127893ee03b01353d89b2a7f602ebb717d4c21411b2d5ed1755

    • SSDEEP

      12288:uid+fLgkaGPugBDKSWKGOoirbnhsGpkEukeg28dWkRqhP7ZwPrsx:cvaxkDKS3PrbhskkEuk284OKF0A

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks