General

  • Target

    a1599b7c295289deef14f193773d92386aead135.rar.tar.gz

  • Size

    1.8MB

  • Sample

    240515-jmm7cafg5v

  • MD5

    9d966086a220219dd70e7ac2d404011a

  • SHA1

    b4c175cd3ad1a2f40fc8fcc452ed3a6338da620a

  • SHA256

    2a5cb6c798fa4f3c8aab7de531f8fd248f784bb11b437ad09c6b1848a7f76ff0

  • SHA512

    72c9702bb244205bf721e6d6885b4e301a24d3200fb1fd38fee3cc52eea68ffa03a70daa6fd51ba1ef544ae7f2f8005e04f66e320bdc85392fffaf60c1c24579

  • SSDEEP

    49152:t+zFciOIdLDTmINDUGixltnJQTYWNvmwGCIy+ZK75yV7l:Cftd7mIJUGivtnJQ8WNmNC2ZSe7l

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SWIFT.exe

    • Size

      4.4MB

    • MD5

      a4f782a6ea448009ba2885a7cca61a7d

    • SHA1

      430ce0174fc9d9554c880cccaac4646d754a1517

    • SHA256

      3d1fecc8cf36f080a0b24fe5bda28dd095fb99702809450f53ca0410f086a5bb

    • SHA512

      4014365441679ea1993a739c918461f71d8fa595acc2d17502a676bca37621ee8a24d2d5682be86b4780ed2e348ce291b0fd8fe16aad0a6f86b6eae6813f750c

    • SSDEEP

      24576:IohsOs9RbgMPdaWer3GeJI+3xydqnZwhQ+Y0mHW2boK0PN0gnRYeF6vGTtZ/xP2T:Io

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks