General

  • Target

    ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

  • Size

    1009KB

  • Sample

    240522-r1smzsef81

  • MD5

    72b1dfb60cae17dc577fa43347f69c41

  • SHA1

    5eeb711eb6ade3532a11443fe10941ab15c47a52

  • SHA256

    ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3

  • SHA512

    627e70d818922bc93784f977e6111f5ec5e87da5c6053317854be7de78dfe31d73783a36cae61d1b8e3c2a7b8a5108c2a0a2a06d49f56fd5377556e8d19f9e01

  • SSDEEP

    24576:TAHnh+eWsN3skA4RV1Hom2KXMmHaukON3e7NDR1kt45:eh+ZkldoPK8YauNI7NV1ko

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

    • Size

      1009KB

    • MD5

      72b1dfb60cae17dc577fa43347f69c41

    • SHA1

      5eeb711eb6ade3532a11443fe10941ab15c47a52

    • SHA256

      ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3

    • SHA512

      627e70d818922bc93784f977e6111f5ec5e87da5c6053317854be7de78dfe31d73783a36cae61d1b8e3c2a7b8a5108c2a0a2a06d49f56fd5377556e8d19f9e01

    • SSDEEP

      24576:TAHnh+eWsN3skA4RV1Hom2KXMmHaukON3e7NDR1kt45:eh+ZkldoPK8YauNI7NV1ko

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks