General

  • Target

    PO.01948725_pdf.exe

  • Size

    299KB

  • Sample

    221207-p4mvssaa9s

  • MD5

    6ba4f0f360a3c3b983ebe85c14a1006e

  • SHA1

    da572bd099a7460175eedf87740307f17ece548c

  • SHA256

    1e52736e367a32baa3f72762da49a9987451874e34f4fbcc8d4afcf15a91e537

  • SHA512

    50567afbd606efbf5f4c8ce5b7cceddeec6cf96a62f78797794f1540244486cc2d32e4680aab777fe709df887ada4b9e385c13a33e78bf269140dbc94f3946d6

  • SSDEEP

    6144:LBnbD9HzWWm32E2JKsOpkE7LN/rxREPlpYh/a5Kor2Q583ryomDg3:FD9yr25KsOpk0nNMrf5UtmDW

Malware Config

Targets

    • Target

      PO.01948725_pdf.exe

    • Size

      299KB

    • MD5

      6ba4f0f360a3c3b983ebe85c14a1006e

    • SHA1

      da572bd099a7460175eedf87740307f17ece548c

    • SHA256

      1e52736e367a32baa3f72762da49a9987451874e34f4fbcc8d4afcf15a91e537

    • SHA512

      50567afbd606efbf5f4c8ce5b7cceddeec6cf96a62f78797794f1540244486cc2d32e4680aab777fe709df887ada4b9e385c13a33e78bf269140dbc94f3946d6

    • SSDEEP

      6144:LBnbD9HzWWm32E2JKsOpkE7LN/rxREPlpYh/a5Kor2Q583ryomDg3:FD9yr25KsOpk0nNMrf5UtmDW

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks