General

  • Target

    Hesap hesaphareketi-01.exe

  • Size

    609KB

  • Sample

    240522-xczdhsce56

  • MD5

    83c0f36678a5e58ebf700975abed6694

  • SHA1

    a91107d56aeafc100f1986421d2d487bdeacafa8

  • SHA256

    fbaf8a59ed3c6d18566b7e254f772870841bfd26224c5e851b7361eb892a4f35

  • SHA512

    fb0be5cafb518286bde8062a746802b4d7a7aaf25c28ff167b5026b947ba81cf8964cfbb1f11a0b462f57ac1e0a58180897eb6f5af0102f8d59184e20ab90b65

  • SSDEEP

    12288:E9Y2gi0zawwRO3XJWV47YLuzfG5XtOOdh6KbMhawlAUh:E9YJzBH4MA59zdE4MhawZ

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    business29.web-hosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7.s8.{OnUP(S

Targets

    • Target

      Hesap hesaphareketi-01.exe

    • Size

      609KB

    • MD5

      83c0f36678a5e58ebf700975abed6694

    • SHA1

      a91107d56aeafc100f1986421d2d487bdeacafa8

    • SHA256

      fbaf8a59ed3c6d18566b7e254f772870841bfd26224c5e851b7361eb892a4f35

    • SHA512

      fb0be5cafb518286bde8062a746802b4d7a7aaf25c28ff167b5026b947ba81cf8964cfbb1f11a0b462f57ac1e0a58180897eb6f5af0102f8d59184e20ab90b65

    • SSDEEP

      12288:E9Y2gi0zawwRO3XJWV47YLuzfG5XtOOdh6KbMhawlAUh:E9YJzBH4MA59zdE4MhawZ

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks