General

  • Target

    MSK203.IMG

  • Size

    1.2MB

  • Sample

    240522-pbfk1sha5z

  • MD5

    471ee4fb4b430b6f1ac80dc1f9e1a352

  • SHA1

    51ec47ccf7f88bd155fe8bc33a2b02704c1db356

  • SHA256

    5e921611411a1f372b02c4655a25f021c666b897e6e4f0ff59ef8a8877792c1f

  • SHA512

    2cd2571edc634a7e3170de6a9988302c5136b4ff0afe47f5deafbcef933d6721c26e59dc66b6360c2b6dc6e13f68178a8de729ec8286328258694867d3b2854b

  • SSDEEP

    12288:2bm37Owct5ERd1ZRad1I5eA2bZxeyCNNrm:2bms5EP1CAsZxs

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6859247669:AAER1Rty_3TqZr1VmGGzXWMbtAZFtnPCWCU/

Targets

    • Target

      MSK203.exe

    • Size

      495KB

    • MD5

      672127d627b0d1ffdc8f4f6a7f6a4697

    • SHA1

      965c08f135e270201ca61122955104c0de39ad9f

    • SHA256

      c26d121b096af68fc785a4e7fbd821c0c63a64abd2a64c9abf237fe98d0ddf42

    • SHA512

      f3e6c7837c767944d7e14cac75e5844fa217cfdc3d6dcae575a7d0ad2740617cce9e53e6b28f947114708361570972150737c9c1e3663b5b3ee9fd55a2d6a746

    • SSDEEP

      12288:Pbm37Owct5ERd1ZRad1I5eA2bZxeyCNNrmj:Pbms5EP1CAsZxse

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks