General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.2583.23619.14250.exe

  • Size

    343KB

  • Sample

    231211-kdj9rsbag5

  • MD5

    5aa23d8b62564d941b9280e3e6a4a7f7

  • SHA1

    05982135347d56efb1009e25f59bb334bcc0ee9f

  • SHA256

    2e8cc38f3632a65650d4cb44f5c9b66b5a31e9e431f21a67615a3566a3f0cb9e

  • SHA512

    f831f2648e211c1c32348a13f9d465371b7581828d5eea339a957c5fb76718ee04654ba7832f53ae6eb7d01fdd558c35b73bdc99559b6a31986bef38d36a7a82

  • SSDEEP

    6144:RMtupv8mx9piku5erIF9XCA2RO0F8S9hIlS8VPR5PJ9+fZmTDmv6MZRQtSYvbQnf:RMMpvJ/k35eUnN2Q0F8Whn8V55/2OCvw

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1183413987946274836/x2mGL5RsDliW33UcztWPXWKu2_GrASEJKuUh8AEd9kIV3tIOo9lsaMizqXjKhhr_O01m

Targets

    • Target

      SecuriteInfo.com.Trojan.PackedNET.2583.23619.14250.exe

    • Size

      343KB

    • MD5

      5aa23d8b62564d941b9280e3e6a4a7f7

    • SHA1

      05982135347d56efb1009e25f59bb334bcc0ee9f

    • SHA256

      2e8cc38f3632a65650d4cb44f5c9b66b5a31e9e431f21a67615a3566a3f0cb9e

    • SHA512

      f831f2648e211c1c32348a13f9d465371b7581828d5eea339a957c5fb76718ee04654ba7832f53ae6eb7d01fdd558c35b73bdc99559b6a31986bef38d36a7a82

    • SSDEEP

      6144:RMtupv8mx9piku5erIF9XCA2RO0F8S9hIlS8VPR5PJ9+fZmTDmv6MZRQtSYvbQnf:RMMpvJ/k35eUnN2Q0F8Whn8V55/2OCvw

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks