General

  • Target

    2023072401 DataMarch.rar

  • Size

    66KB

  • Sample

    240326-ckr9ysbf95

  • MD5

    7125f9faec13b283d0a5606ef80e92e2

  • SHA1

    2e7a65ecf59e3524f54be7604ea0b64a891f38a4

  • SHA256

    21a1c8137bcb253a161b10f53d260c73f3b38bf5397648ccbcaf9e91066de4b7

  • SHA512

    2b835b5ca3412c7c8cad6138515c06436f70a0828a58a1f93e42470831d145214b2ddf6e851a20d174017b377579ac9bee645d58974f9a41622c1ca2bcc19778

  • SSDEEP

    1536:27hA8YNESvTjyWwf1hp0zU191vsDuStGtNShbQCWtzU:6nY6S3y7NhazU199CxtGtNSNmU

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      2023072401 DataMarch.vbs

    • Size

      166KB

    • MD5

      f4b9002a475115cb909549d539b624bd

    • SHA1

      936174112283c206af454063673e4a068328e85b

    • SHA256

      d5ff5e2daa191c35c06516f89b81bc682e7ac53bdfaea3ede48e84191532f375

    • SHA512

      0013db6fdc1d0d7b7614ca639eb0f698a6cce2687eb99bfa22536b6b6731ba5c942ba57209d18c33017f6ea9ea62bad7ccb43be5d1add018713ec2d12cd8ac69

    • SSDEEP

      3072:1pK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DyRQe2:1pKyPeadLaz+k0zn1j7rZeqGbHfNccku

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks