General

  • Target

    1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

  • Size

    420KB

  • Sample

    240514-bvbjhsdf2y

  • MD5

    65ae45789b58f1e03a4f8c3f178e6b30

  • SHA1

    4eb87b3825da0d23d7f7091c2976e1e95cc40907

  • SHA256

    1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

  • SHA512

    6d7da073e7280bf84612920a6371b19a1226fa50747587dbfe9fe10ed6bdf514ab8b171605d34a0a090d5f9ee3dbe4ec5e6fa379a73dc4675c8f4e46e359e864

  • SSDEEP

    6144:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHu8uniSHBMixiMK6G+ZFrTUvCp4sJgpQMD:31iQpozwjTqCfgdhd/+Z4uCz2BFmDiP

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

    • Size

      420KB

    • MD5

      65ae45789b58f1e03a4f8c3f178e6b30

    • SHA1

      4eb87b3825da0d23d7f7091c2976e1e95cc40907

    • SHA256

      1ccd3e2580b4e0de27bfeae3a92d638230c573704c66a06a0e11018224d176a0

    • SHA512

      6d7da073e7280bf84612920a6371b19a1226fa50747587dbfe9fe10ed6bdf514ab8b171605d34a0a090d5f9ee3dbe4ec5e6fa379a73dc4675c8f4e46e359e864

    • SSDEEP

      6144:NZ+RwPONXoRjDhIcp0fDlavx+W26nAHu8uniSHBMixiMK6G+ZFrTUvCp4sJgpQMD:31iQpozwjTqCfgdhd/+Z4uCz2BFmDiP

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks