General

  • Target

    2acddc678ea970cfb45042c954b8a268.zip

  • Size

    672KB

  • Sample

    230605-mrt28sge5x

  • MD5

    389fe6f2e64cc0306a72301e21204de9

  • SHA1

    9d4ea43ff5ac6e1cc193c810230b2e496c396552

  • SHA256

    b528fb4eed7042c51b8ceea829129e945abcffd7b6c11eb00171e13cbf3b0e8d

  • SHA512

    863879524f8c222b69f2b7aa9a6ea0633ea081d1218a1d07471f3dee8a4e9e722d0456fed2d651f9556c4e81edf0351c72da8bbd925f9c5f4de4235def8a7c24

  • SSDEEP

    12288:8pZaL0s0g7/6/s7MHqdp0dwValW9FHgUVt+Ul/qMgm7MMPMwZkRr1:8pZaos0Ay/S9UdwVRzHgUVt+D+MsFoJ

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      K.V.L. EUR 5,418.41 20230131144411-PDF.exe

    • Size

      815KB

    • MD5

      2acddc678ea970cfb45042c954b8a268

    • SHA1

      e27c3436cb48d0b49adc30b19a5471d6960de709

    • SHA256

      1fed6157fe887393791035cca1424ff56a3416202a55c58a6b44f902b6d5d873

    • SHA512

      670e65b75b155dc63948d6d730f90e814c1c385ba26e04853dfa01070f52da3fa6ec6b4aa296adaf5c4de271ca3fbf2bb50e85456685270a9ecf0325b92f244e

    • SSDEEP

      24576:+MqsFHlWxMiQW/O4ue7AjtsVNL2HzCBjHKP+M:yulYMiQWmS7WtMcHzCwP

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks