General

  • Target

    Flab 423800-213-KFO-872-1-9.vbs

  • Size

    5KB

  • Sample

    240522-w8cnyscc57

  • MD5

    4f71bc91cc015856a2a5029d880f02f0

  • SHA1

    3f9e609f67057c573a15f469e4bb5e64c571174c

  • SHA256

    836259b5e47a4d9f6fdd2955e69645b8aa70bca6d139b0eb99038641db38dbe6

  • SHA512

    30de245e61fd2cf7462a9e4949a04acfd17da6ffd074886d440b11f76bc4c28b336a9a5ced2785695fa8049348cc152d35b43ab487ff193e6f001a3d23243c38

  • SSDEEP

    96:Q7ZrI+0JYJMAAiOL1vOZypNWiu/hlbz9cZh+xFUMLCT0MTUmdrQfp:Q150+GAAlOZypNWiu/hlPahKLCQMUhfp

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Flab 423800-213-KFO-872-1-9.vbs

    • Size

      5KB

    • MD5

      4f71bc91cc015856a2a5029d880f02f0

    • SHA1

      3f9e609f67057c573a15f469e4bb5e64c571174c

    • SHA256

      836259b5e47a4d9f6fdd2955e69645b8aa70bca6d139b0eb99038641db38dbe6

    • SHA512

      30de245e61fd2cf7462a9e4949a04acfd17da6ffd074886d440b11f76bc4c28b336a9a5ced2785695fa8049348cc152d35b43ab487ff193e6f001a3d23243c38

    • SSDEEP

      96:Q7ZrI+0JYJMAAiOL1vOZypNWiu/hlbz9cZh+xFUMLCT0MTUmdrQfp:Q150+GAAlOZypNWiu/hlPahKLCQMUhfp

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks