General

  • Target

    8c0affc928dd817fa864a9211f11f89fd36701aa

  • Size

    571KB

  • Sample

    230112-xwb3bshg68

  • MD5

    95bfd4665a21e54e620676e1cef82fc2

  • SHA1

    8c0affc928dd817fa864a9211f11f89fd36701aa

  • SHA256

    915cb8994b02a7d735b230b000ee1d7797500c5c0846b24103a9ad63956cbb41

  • SHA512

    7ec7c12d4369b61a282eec87be532923f8aa2b24e24a246834030610e1d143904e25c27f1328186a2100d157eb3104e7e5ef3e20aca8c75370fdb043153d7a19

  • SSDEEP

    12288:gYziYVrBhcLnvtVsKECqKgYGT+mSziTPsJrnK4/im:gYziY9q3zcVYGTRaib0n1im

Malware Config

Targets

    • Target

      8c0affc928dd817fa864a9211f11f89fd36701aa

    • Size

      571KB

    • MD5

      95bfd4665a21e54e620676e1cef82fc2

    • SHA1

      8c0affc928dd817fa864a9211f11f89fd36701aa

    • SHA256

      915cb8994b02a7d735b230b000ee1d7797500c5c0846b24103a9ad63956cbb41

    • SHA512

      7ec7c12d4369b61a282eec87be532923f8aa2b24e24a246834030610e1d143904e25c27f1328186a2100d157eb3104e7e5ef3e20aca8c75370fdb043153d7a19

    • SSDEEP

      12288:gYziYVrBhcLnvtVsKECqKgYGT+mSziTPsJrnK4/im:gYziY9q3zcVYGTRaib0n1im

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks