General

  • Target

    file.exe

  • Size

    800KB

  • Sample

    230322-lyfyhsgb56

  • MD5

    c35736429b30030acb60cb19c771649e

  • SHA1

    e45a11358fa376cc0dcf103e431aa3ea805370f0

  • SHA256

    433bae3045c110790a9ba2a11bbbc39f5fd10a36c0422bcd6e706b0eedbba66b

  • SHA512

    7e664ca187045a9dc1fbf432ad13f322fa33db7de15481c7bef9b6fe1ae59804ce396c5e1d40d15f8eb4c921bec3cab12336491882656927fa38897afd002b16

  • SSDEEP

    6144:BZbvpVUeRkrE4sZ5vnZI1ET94aVgrpkghZuOOIZ34lQP9MWT:HTUeR/3Pnikled3ZupIV4m

Malware Config

Targets

    • Target

      file.exe

    • Size

      800KB

    • MD5

      c35736429b30030acb60cb19c771649e

    • SHA1

      e45a11358fa376cc0dcf103e431aa3ea805370f0

    • SHA256

      433bae3045c110790a9ba2a11bbbc39f5fd10a36c0422bcd6e706b0eedbba66b

    • SHA512

      7e664ca187045a9dc1fbf432ad13f322fa33db7de15481c7bef9b6fe1ae59804ce396c5e1d40d15f8eb4c921bec3cab12336491882656927fa38897afd002b16

    • SSDEEP

      6144:BZbvpVUeRkrE4sZ5vnZI1ET94aVgrpkghZuOOIZ34lQP9MWT:HTUeR/3Pnikled3ZupIV4m

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks