General

  • Target

    2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a

  • Size

    871B

  • Sample

    240710-fbqljsygpg

  • MD5

    6486dce20645a3671d2eb9cb410e572e

  • SHA1

    9d70614d14d073eb17a87ca4a62e039779b6a8c1

  • SHA256

    1fe9f14673b0578284b548c8bbdd10d867a354879b802624662f2dacd7596b6f

  • SHA512

    681fc4c97505f49517df7a7d3166f473d89218b552465e7886e1dab447c8e2e683dd2869f64266a5700fa052b8851fa6297e21b8f010db011e8f59f3dd6c4e08

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    bizr usjt guapiims

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a

    • Size

      7KB

    • MD5

      bc80530079fd263dd26e267d797cd4ad

    • SHA1

      54215542d4c17815915c2aa3efe76605b394092f

    • SHA256

      2eeec947de3dee177c0a5ff2727e98953d0285f174b43074fee0a6e909c1593a

    • SHA512

      64799c7cd10dff4c002f7ac77db485593d13b6f79a983e9b7c785e8a411958b10238daae69f8549e52977413eb0226070448f7813283780563bd493afc7b8580

    • SSDEEP

      192:tIiianBNVi8xF1wG1FbIPieeRXtXqHUUN7i592E:tIiianBNVi8n1wG1FbIPieeRXtXqHUUW

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks