General

  • Target

    ENQUIRY.exe

  • Size

    1.3MB

  • Sample

    200624-r3ph8m4q3e

  • MD5

    b7678d22e54d1c21181a9c4dee044ee9

  • SHA1

    9c3099c3f24da080cea26ed6bebef8f2f7a0491c

  • SHA256

    b9457b508677dbfe250a6a41a890d921e9bdcab9c8112bd86837d2eecff05f4b

  • SHA512

    73325a18a2b63114c4ee1efb8fa32084ad2777190bf9229deb19978a0b1c1a33baaee24c2b2c4bfe0060eaedf427361dbbb2591f7c221e69256916bc95744eb0

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.sarniotex.com
  • Port:
    587
  • Username:
    millions@sarniotex.com
  • Password:
    dL@KoFb6

Targets

    • Target

      ENQUIRY.exe

    • Size

      1.3MB

    • MD5

      b7678d22e54d1c21181a9c4dee044ee9

    • SHA1

      9c3099c3f24da080cea26ed6bebef8f2f7a0491c

    • SHA256

      b9457b508677dbfe250a6a41a890d921e9bdcab9c8112bd86837d2eecff05f4b

    • SHA512

      73325a18a2b63114c4ee1efb8fa32084ad2777190bf9229deb19978a0b1c1a33baaee24c2b2c4bfe0060eaedf427361dbbb2591f7c221e69256916bc95744eb0

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Tasks