General

  • Target

    ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f

  • Size

    611KB

  • Sample

    240428-bjcmface92

  • MD5

    90ef1b43841cec6ada8456d6001cdfab

  • SHA1

    f4883709e25e8214a514a5a857d271ed522e2d1e

  • SHA256

    ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f

  • SHA512

    a64011db120874c49e0fa96cb56c2fe7be520654cfcc45a200f673185911d0d9936998e969f436310ad025fd191fe3901fc60669f9a50a53e99a4c92f1899b4f

  • SSDEEP

    12288:3yhaWvkOpKFP5eJBXY2PYMK2A4x3t45Jb+uh1ZaxfJz1+Ce5x5udkBuuQRo:3yXoh6Rwyxt45Jnjaxf11kMLuQRo

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    terminal4.veeblehosting.com
  • Port:
    587
  • Username:
    appo@kailmaticarbon.com
  • Password:
    Ifeanyi1987@
  • Email To:
    deepocket@eleven-end-sun.com

Targets

    • Target

      ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f

    • Size

      611KB

    • MD5

      90ef1b43841cec6ada8456d6001cdfab

    • SHA1

      f4883709e25e8214a514a5a857d271ed522e2d1e

    • SHA256

      ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f

    • SHA512

      a64011db120874c49e0fa96cb56c2fe7be520654cfcc45a200f673185911d0d9936998e969f436310ad025fd191fe3901fc60669f9a50a53e99a4c92f1899b4f

    • SSDEEP

      12288:3yhaWvkOpKFP5eJBXY2PYMK2A4x3t45Jb+uh1ZaxfJz1+Ce5x5udkBuuQRo:3yXoh6Rwyxt45Jnjaxf11kMLuQRo

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks