General

  • Target

    Proforma Inv.exe

  • Size

    434KB

  • Sample

    220407-sp6adaehdm

  • MD5

    189ad2733ba3c8baa0d9fb41e4223d92

  • SHA1

    90d2762579dfd97d7b767662566f3a623766dd0a

  • SHA256

    d73763f8b8d4eb91dec386eb7a2ebf9a8a9b40c6b028d57e6144ed74551d460b

  • SHA512

    a255eb116180e54ca4966b6596adccffb56deac442f64ed570814f2205811b3e5d2263ce4f0f2183851530b962f754fe3fe3561dda93dd3e20f6ac46dc6f0901

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.safalaw.com.ph
  • Port:
    587
  • Username:
    ipdepartment@safalaw.com.ph
  • Password:
    #Risel767

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.safalaw.com.ph
  • Port:
    587
  • Username:
    ipdepartment@safalaw.com.ph
  • Password:
    #Risel767
  • Email To:
    ongod9755@gmail.com

Targets

    • Target

      Proforma Inv.exe

    • Size

      434KB

    • MD5

      189ad2733ba3c8baa0d9fb41e4223d92

    • SHA1

      90d2762579dfd97d7b767662566f3a623766dd0a

    • SHA256

      d73763f8b8d4eb91dec386eb7a2ebf9a8a9b40c6b028d57e6144ed74551d460b

    • SHA512

      a255eb116180e54ca4966b6596adccffb56deac442f64ed570814f2205811b3e5d2263ce4f0f2183851530b962f754fe3fe3561dda93dd3e20f6ac46dc6f0901

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks