General

  • Target

    Articoli richiesti.vbs

  • Size

    53KB

  • Sample

    230209-matp5sfg21

  • MD5

    68a4d5e4c541961d428996136e9739aa

  • SHA1

    ac722c0b712636eb7efbd995035dd149311e0ee9

  • SHA256

    0dadaf0eb1832bfa87259ffa7481ab5cfdd40455dd6643858f856afceaf17c14

  • SHA512

    379d322247d03e9826ff4bc0de5a849da314f8631b59f0ccf36949e98999f11b84ad564f84e7497755eb333aa0c82381e844a16f6fc533fcec86ddb710e6d517

  • SSDEEP

    1536:Y7ApYVwpqGY8n/pevDkFwjYkRaSQSAykbhATO4RWKIRJRa:Y7ApYVIsvDkajJUSaxF4Rj2fa

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5693068931:AAGSQSNIWDJM1FzeZVNHS020I9wVBrQdkRM/

Targets

    • Target

      Articoli richiesti.vbs

    • Size

      53KB

    • MD5

      68a4d5e4c541961d428996136e9739aa

    • SHA1

      ac722c0b712636eb7efbd995035dd149311e0ee9

    • SHA256

      0dadaf0eb1832bfa87259ffa7481ab5cfdd40455dd6643858f856afceaf17c14

    • SHA512

      379d322247d03e9826ff4bc0de5a849da314f8631b59f0ccf36949e98999f11b84ad564f84e7497755eb333aa0c82381e844a16f6fc533fcec86ddb710e6d517

    • SSDEEP

      1536:Y7ApYVwpqGY8n/pevDkFwjYkRaSQSAykbhATO4RWKIRJRa:Y7ApYVIsvDkajJUSaxF4Rj2fa

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Blocklisted process makes network request

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks