General

  • Target

    a51e8dfe9b216175acbc225de1ceb0f5.exe

  • Size

    515KB

  • Sample

    220406-t1xytabhhk

  • MD5

    a51e8dfe9b216175acbc225de1ceb0f5

  • SHA1

    36d347c6139c66656becec8bf698b1d6281b5b5f

  • SHA256

    7b29b24825a35a5d19c29cc434143b3f2937acbb86b959f86a3945f13264e84e

  • SHA512

    28c0285df3661ff2bb069f695117d0ca3e209cbde52bf0a73b71c14aad8d4db648fea11dd52b4847b5e5becafcab6509be35f1a176c594d04e80a12fd23eb48c

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    webmail.eurologictics.com
  • Port:
    587
  • Username:
    Support@eurologictics.com
  • Password:
    9_Qimn35

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    webmail.eurologictics.com
  • Port:
    587
  • Username:
    Support@eurologictics.com
  • Password:
    9_Qimn35
  • Email To:
    asala.almosawi@anwar-alhermal.com

Targets

    • Target

      a51e8dfe9b216175acbc225de1ceb0f5.exe

    • Size

      515KB

    • MD5

      a51e8dfe9b216175acbc225de1ceb0f5

    • SHA1

      36d347c6139c66656becec8bf698b1d6281b5b5f

    • SHA256

      7b29b24825a35a5d19c29cc434143b3f2937acbb86b959f86a3945f13264e84e

    • SHA512

      28c0285df3661ff2bb069f695117d0ca3e209cbde52bf0a73b71c14aad8d4db648fea11dd52b4847b5e5becafcab6509be35f1a176c594d04e80a12fd23eb48c

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP

      suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks