General

  • Target

    0600493ba6ab2f81f2b6e7d2828e07626df190f953068637c8ce82236222c0e8

  • Size

    164KB

  • Sample

    240523-by4pgaha48

  • MD5

    82f10e879999652cdfe5f37f87993523

  • SHA1

    0847ba136ab8971cc9b10ed7ca1d1eb099872469

  • SHA256

    0600493ba6ab2f81f2b6e7d2828e07626df190f953068637c8ce82236222c0e8

  • SHA512

    3ba8671eede48543df309c13ffc9ac0ef245d5ece2e4d6f1bf3dde6e30ceb20cd4ccd3d0560cd09c0be14cf889f03381c5fc4b0a9cc553c61c12ff5d462a40c3

  • SSDEEP

    3072:FlbGjlIw0E1kTYVEUerWOp7Kakn6piKRC/TScWmrs:FAiMwYVrcz7Kabg/GcTr

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0600493ba6ab2f81f2b6e7d2828e07626df190f953068637c8ce82236222c0e8

    • Size

      164KB

    • MD5

      82f10e879999652cdfe5f37f87993523

    • SHA1

      0847ba136ab8971cc9b10ed7ca1d1eb099872469

    • SHA256

      0600493ba6ab2f81f2b6e7d2828e07626df190f953068637c8ce82236222c0e8

    • SHA512

      3ba8671eede48543df309c13ffc9ac0ef245d5ece2e4d6f1bf3dde6e30ceb20cd4ccd3d0560cd09c0be14cf889f03381c5fc4b0a9cc553c61c12ff5d462a40c3

    • SSDEEP

      3072:FlbGjlIw0E1kTYVEUerWOp7Kakn6piKRC/TScWmrs:FAiMwYVrcz7Kabg/GcTr

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks