General

  • Target

    53b8fbbb4860cbbc9210d0a87c20dfed55e7d36585e53ef108957ec7e2140ff6img.img

  • Size

    1.2MB

  • Sample

    231207-x3z3qsef88

  • MD5

    f04772e5d1bd0f364f306f19fc197b8f

  • SHA1

    75f077b5619cec568224e643b052ff479291de91

  • SHA256

    53b8fbbb4860cbbc9210d0a87c20dfed55e7d36585e53ef108957ec7e2140ff6

  • SHA512

    cc917d7060819007aaf97196e81e7006c581665d1fa176273b24eacc3ffb3df5fa399f8241963384296064cb2cc9c013b341893a63e65ae8cf2f2aa70478b568

  • SSDEEP

    24576:E5/qXzjSAPzlxVMaIqCZoHmR4ewdHyab:YyzjSezlH0eGRdaLb

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      swift2023-05-12-100838,jpg.exe

    • Size

      704KB

    • MD5

      e90efe74ac142f12a73de061bef9c35e

    • SHA1

      4856761abdbcb74360f3176a8430593d86c8189b

    • SHA256

      61f68328e18fc4e7cda2431d6002a4906de64103eb528b0b4002056cd69c78b8

    • SHA512

      e9d94935c1b6547d4432e859ea0fa9d441b56c2379364e3b76b4b44061a505f36e449c1c57ed57f9df4e1eb076cfdf054b54f86baeba7fa2df4240729c3a4254

    • SSDEEP

      12288:b5AGQaueH5qYInzjfK9yPiYlxVUCdSEpIqCbv5j2FHZKhJV14esG7+d8bUO8ceEq:b5/qXzjSAPzlxVMaIqCZoHmR4ewdHyab

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks