General

  • Target

    1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe

  • Size

    762KB

  • Sample

    240107-x3mgmscdaq

  • MD5

    3e9a543b85c85a0b808902b0b6cef9b2

  • SHA1

    29d589b838b4e1a5e54a6bfe52da0d5859609865

  • SHA256

    1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695

  • SHA512

    f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6

  • SSDEEP

    12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6857395601:AAEr0Ki03_UqNs4qlOxRNOhnjU8odyo6de4/

Targets

    • Target

      1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695exe.exe

    • Size

      762KB

    • MD5

      3e9a543b85c85a0b808902b0b6cef9b2

    • SHA1

      29d589b838b4e1a5e54a6bfe52da0d5859609865

    • SHA256

      1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695

    • SHA512

      f212b3a2f4c25701df3f41be93c13cf9a6a84e1affd4e8b0f7b9fb5bc0689a1b3a1c55052c99fca314f540199997a8c265f9f447fe8b013a085a199a7fffb3c6

    • SSDEEP

      12288:aHW7TohIU2CoLBPdV+GLBOeUjYb9qUp5jlnRLm5bvL2z4is:a27SELNdYGL8eUjYbMUp5RnRLm5LLw4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks