General

  • Target

    pro-forma invoice.exe

  • Size

    450KB

  • Sample

    200630-mfsfwcbrqj

  • MD5

    441166bc629c6bceb309d8004e21ded4

  • SHA1

    8e9a24411ac1b6605296c3ba333e2549f1ea44ec

  • SHA256

    a9f98038cac91d7d9f92301d7738f9187fdc1a879aa9db3373ce1fbe1bbd6eae

  • SHA512

    a953e9014228508d66eda8856a8babbec09aa19da481f71a412174316d311983beade383507628a6b53853bbf1b70da5c2ff2df990db45f89e7826f142d73678

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    business41.web-hosting.com
  • Port:
    587
  • Username:
    kevin@alfexotrading.info
  • Password:
    london1759

Targets

    • Target

      pro-forma invoice.exe

    • Size

      450KB

    • MD5

      441166bc629c6bceb309d8004e21ded4

    • SHA1

      8e9a24411ac1b6605296c3ba333e2549f1ea44ec

    • SHA256

      a9f98038cac91d7d9f92301d7738f9187fdc1a879aa9db3373ce1fbe1bbd6eae

    • SHA512

      a953e9014228508d66eda8856a8babbec09aa19da481f71a412174316d311983beade383507628a6b53853bbf1b70da5c2ff2df990db45f89e7826f142d73678

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Tasks