General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.20943.19478

  • Size

    541KB

  • Sample

    231211-nd6dsadahr

  • MD5

    42e3f6af3958538a12e6cb658f81f7bb

  • SHA1

    5bfebb36c4c0e312fa2231825a564f61ce4b756c

  • SHA256

    1285b4c3035e7e99784fa960522765ef492b5425bc9c02d002f1d076692992de

  • SHA512

    a50301b45d03d1b9b3b3836a196ece2ff15f2e98a71756d252dd135e95ea5b823e5e5207a7a4e9bc80e020dc9fa378695528817cb97e792f2e7bf1c396317431

  • SSDEEP

    12288:G3IU8S6eUdSV/9gUzpjXJdZ03XNF5cXRS0nvYLltWyy0H7BTvCyIwB:8ItSAdSDpjX/ZiwdaZ7BTdIw

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SecuriteInfo.com.Win32.PWSX-gen.20943.19478

    • Size

      541KB

    • MD5

      42e3f6af3958538a12e6cb658f81f7bb

    • SHA1

      5bfebb36c4c0e312fa2231825a564f61ce4b756c

    • SHA256

      1285b4c3035e7e99784fa960522765ef492b5425bc9c02d002f1d076692992de

    • SHA512

      a50301b45d03d1b9b3b3836a196ece2ff15f2e98a71756d252dd135e95ea5b823e5e5207a7a4e9bc80e020dc9fa378695528817cb97e792f2e7bf1c396317431

    • SSDEEP

      12288:G3IU8S6eUdSV/9gUzpjXJdZ03XNF5cXRS0nvYLltWyy0H7BTvCyIwB:8ItSAdSDpjX/ZiwdaZ7BTdIw

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks