General
- Target https://cosmeticapampa.com.ar/ptk.exe
- Sample260731-gpv9mabl4x
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.anmarinee.it.com
-
Port
21
-
Username
-
Password
nHacaNzaz&,rdS4n
Extracted
Family
-
agenttesla
Attributes
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
true
-
enable_cookies
true
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
2
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
true
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
startup_directory_name
eXCXES
-
startup_env_name
appdata
-
startup_installation_name
eXCXES.exe
-
startup_reg_name
eXCXES
-
tor_pid
false
Targets
-
- Target https://cosmeticapampa.com.ar/ptk.exe
Score10/10-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2