General

  • Target

    62ed3278514f6c82e9cd767be0289915083a2e251a30333d6e12326eb2ef2a32

  • Size

    921KB

  • Sample

    240604-b2ejragg8x

  • MD5

    1a77e07dede4116269be28bca2bcfd60

  • SHA1

    637308d5489623982c386076bdb87f3f0df706a0

  • SHA256

    62ed3278514f6c82e9cd767be0289915083a2e251a30333d6e12326eb2ef2a32

  • SHA512

    e07be3d9ce9ef799507f5524ca91efd76d7d86b80f2a870f7508b0846c48ca4e5099ada42b7ed660efc6d2d3472b43411f7ba80ec5e062812e5ca64faad1bb6a

  • SSDEEP

    24576:p8oMOoLsBmcTdhtzoh9qMC6qu7L3o+fYHG:nhoLs3hpko3sE+s

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.outlook.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Made2020

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      62ed3278514f6c82e9cd767be0289915083a2e251a30333d6e12326eb2ef2a32

    • Size

      921KB

    • MD5

      1a77e07dede4116269be28bca2bcfd60

    • SHA1

      637308d5489623982c386076bdb87f3f0df706a0

    • SHA256

      62ed3278514f6c82e9cd767be0289915083a2e251a30333d6e12326eb2ef2a32

    • SHA512

      e07be3d9ce9ef799507f5524ca91efd76d7d86b80f2a870f7508b0846c48ca4e5099ada42b7ed660efc6d2d3472b43411f7ba80ec5e062812e5ca64faad1bb6a

    • SSDEEP

      24576:p8oMOoLsBmcTdhtzoh9qMC6qu7L3o+fYHG:nhoLs3hpko3sE+s

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks