General

  • Target

    Doc710001.exe

  • Size

    875KB

  • Sample

    221206-tgh1jsfc8y

  • MD5

    0223f20a84ee37dbd83cccbf6d135f8d

  • SHA1

    ba3e3dd15132008e3c58a9bf3ce48f4fe84fb205

  • SHA256

    ab880980b0193a388f1691809159937e50ee28dea4475da796ceab667e7a1c21

  • SHA512

    31325296a31bfdae219a1b5df20a79aa3cca6999b54d5d7ffe00f4c137fba0354231be51d09abf544eff8c013b877f9edadbbadf6d49c40888948db8fffc1929

  • SSDEEP

    24576:EomxinhTacne31m5xDKqMFtBU6JkLQFXU5:EoKCTVBKRtBUC0Q

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5427131313:AAFMklRuqjznT6zTYRXZ7Ee0IUNwtacAaPk/

Targets

    • Target

      Doc710001.exe

    • Size

      875KB

    • MD5

      0223f20a84ee37dbd83cccbf6d135f8d

    • SHA1

      ba3e3dd15132008e3c58a9bf3ce48f4fe84fb205

    • SHA256

      ab880980b0193a388f1691809159937e50ee28dea4475da796ceab667e7a1c21

    • SHA512

      31325296a31bfdae219a1b5df20a79aa3cca6999b54d5d7ffe00f4c137fba0354231be51d09abf544eff8c013b877f9edadbbadf6d49c40888948db8fffc1929

    • SSDEEP

      24576:EomxinhTacne31m5xDKqMFtBU6JkLQFXU5:EoKCTVBKRtBUC0Q

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks