General

  • Target

    DA14680-01F08A92 24K.exe

  • Size

    893KB

  • Sample

    240522-gn6nzaed8w

  • MD5

    ed567007d635c168315c462b2366b9ce

  • SHA1

    4e95b7774838bb0521b4ff4bd149dc1b27f5c50e

  • SHA256

    216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082

  • SHA512

    b8d580f3b5fc73f6d6eb5fa6b75a1eba2ca1ed020d731cd7d116c582681efe56d5ba0f79dade933dcb73cdecf9440b9f788933a571d1d2280478ccd9d52608d5

  • SSDEEP

    12288:ylYifTU6KiRpwR5vP7EgYsK4clfXVmSSO3ItJnsY3Haahj6EMJbOpDZzlwMSYvMy:Fi3KoGbEgxch4ptP3H9hj67ADz2c

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.medicalhome.com.pe
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    MHinfo01

Targets

    • Target

      DA14680-01F08A92 24K.exe

    • Size

      893KB

    • MD5

      ed567007d635c168315c462b2366b9ce

    • SHA1

      4e95b7774838bb0521b4ff4bd149dc1b27f5c50e

    • SHA256

      216176b4ebbcf066ad142fb327e53c7765e60261ef13d4ec45bb02d0db117082

    • SHA512

      b8d580f3b5fc73f6d6eb5fa6b75a1eba2ca1ed020d731cd7d116c582681efe56d5ba0f79dade933dcb73cdecf9440b9f788933a571d1d2280478ccd9d52608d5

    • SSDEEP

      12288:ylYifTU6KiRpwR5vP7EgYsK4clfXVmSSO3ItJnsY3Haahj6EMJbOpDZzlwMSYvMy:Fi3KoGbEgxch4ptP3H9hj67ADz2c

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks