General
- Target 1786937343-111511-7730-27262-1.eml
- Size 2.2MB
- Sample260817-d9jjsasfqa
- SHA256 da7d7e6cc65ef257c25428f77f34378e8a009051579eba4b08b52bf01466472d
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.vilimorin.com
-
Port
21
-
Username
-
Password
z}tT#ZeUhW_^SWS7
Targets
-
- Target info_New_Order_7132026 _PDF.shtml(~99 KB).JS
- Size 3.6MB
- SHA256 fe65f79d491a7fedcf1af8d64667c308a5b15ae14b9e4ef57e8a398d588a1b71
Score10/10-
Detects DonutLoader
-
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target sanmina-sci(m)sdnbhd.jpg
- Size 31KB
- SHA256 e7af8607b2dca855799f4c95a885d05a263a73e1765d07a3c5b750307d7af6cf
Score1/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2