General

  • Target

    TT COPY.zip

  • Size

    496KB

  • Sample

    221123-kbabsacb7z

  • MD5

    ecd8b44f5889d074e0820f761e99116b

  • SHA1

    8e345762f862e969ae371ac40fb7bb95c2fc4f17

  • SHA256

    7bb03cdd038838a4379d26debab4f5b5f4a499d8473ced13cfd419bfb6c72064

  • SHA512

    57bb37b44702a504664802e55249bb211d93a93fe312cb56952c26f8dad50b11e1db06d0ce396258bf858ae8b6c63577118a2ab21220aa99215277d980047711

  • SSDEEP

    12288:4BLVK9YR87pMVPaHl00o2E1zOsfhlpvcYzK6s8nVHTqYG:4BLUOR86yHzERPJzs8BK

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      TT COPY.exe

    • Size

      562KB

    • MD5

      151d8349aa1f8d3697c55b1707ca2789

    • SHA1

      ed745b72c682d4b74dec09af7bce32d7acebab4c

    • SHA256

      ea43d517a6f297bacd8199f6df1f0cfaa00acac3c3c2eb125093df80c73a87a6

    • SHA512

      5930a050134b953121b024d169f71d167e675792ec55b837c5f11e33665875f09240ce7281c1171ef20f7d51c88c34bc4ad92d4b86afb8f2827f10439189b4ae

    • SSDEEP

      12288:pJgABfUndS7pkVPaPl00WSETzOKNh3pvckiU3Z7iPuW:pJguUdimyPTEnXfFl

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks