General

  • Target

    Purchase order.bat.exe

  • Size

    835KB

  • Sample

    240515-nhpxlafa7t

  • MD5

    ef01c19a0d0261cd97064f2608034f50

  • SHA1

    a6462d26c8b42fc7b7ef7b50c5e5d5004c7362f8

  • SHA256

    6443b593fc020a993974a850a6609c498398ac6d8368607dd2bc1ad1d785f38b

  • SHA512

    077f2a4cbe6e35c08e0168864c23d4e8a817d77d6157c6ff4e91a82929874d446b54ac85881c56b6c4f698cc91f2fb3f5cc13170111bec63390536ac1ef1124f

  • SSDEEP

    12288:9EmsnD7eLAfyX4wBSG4Ddbph+Kl+GWqZK2iTrd4cEsRnjPwTA5E9Q4akR:XsnD75KoQd4Zq8+GWuKhrd7BjTdC

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Purchase order.bat.exe

    • Size

      835KB

    • MD5

      ef01c19a0d0261cd97064f2608034f50

    • SHA1

      a6462d26c8b42fc7b7ef7b50c5e5d5004c7362f8

    • SHA256

      6443b593fc020a993974a850a6609c498398ac6d8368607dd2bc1ad1d785f38b

    • SHA512

      077f2a4cbe6e35c08e0168864c23d4e8a817d77d6157c6ff4e91a82929874d446b54ac85881c56b6c4f698cc91f2fb3f5cc13170111bec63390536ac1ef1124f

    • SSDEEP

      12288:9EmsnD7eLAfyX4wBSG4Ddbph+Kl+GWqZK2iTrd4cEsRnjPwTA5E9Q4akR:XsnD75KoQd4Zq8+GWuKhrd7BjTdC

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks