General
-
Target
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd
-
Size
245KB
-
Sample
240430-btj49sgc53
-
MD5
1ec597a87537758c970f797e4d1a3bc6
-
SHA1
eb861337937ab27ebb4f94945047c83f9886cfdb
-
SHA256
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd
-
SHA512
260cde0b3f2feaf7c07d345d34c32550f6af4496de734eb2f5a2fe0f398ec88f8a66de8f62b8e0d645535cfe4e1d84b94bc071f6875b66cdec22d8912a15f2b5
-
SSDEEP
3072:1YBoUQk4tnyW0NYmA0pJT+9SZfG5utzLOC8N51QHGqVL:1GoUQk4tnyW81A0pJkSZ+ozKC82Hv
Behavioral task
behavioral1
Sample
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ykqatar.com - Port:
587 - Username:
[email protected] - Password:
kh831975@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.ykqatar.com - Port:
587 - Username:
[email protected] - Password:
kh831975@
Targets
-
-
Target
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd
-
Size
245KB
-
MD5
1ec597a87537758c970f797e4d1a3bc6
-
SHA1
eb861337937ab27ebb4f94945047c83f9886cfdb
-
SHA256
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd
-
SHA512
260cde0b3f2feaf7c07d345d34c32550f6af4496de734eb2f5a2fe0f398ec88f8a66de8f62b8e0d645535cfe4e1d84b94bc071f6875b66cdec22d8912a15f2b5
-
SSDEEP
3072:1YBoUQk4tnyW0NYmA0pJT+9SZfG5utzLOC8N51QHGqVL:1GoUQk4tnyW81A0pJkSZ+ozKC82Hv
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1