General

  • Target

    15f2a4a7c858748411065c202297600b073a72671eaa30ba590c2eb4a437172d

  • Size

    315KB

  • Sample

    240527-bscnssbc5v

  • MD5

    9ce1254637bf6e6ffc142e6bb7bfad96

  • SHA1

    a9ac0f6b9cced4c39fd9839bc6b28d78fe014d55

  • SHA256

    15f2a4a7c858748411065c202297600b073a72671eaa30ba590c2eb4a437172d

  • SHA512

    d1f291fcbb8244a3f8c03a4d20d770c554dd7e0b72fe2ec0e66b62a0afd140006db417b67785aee5bffc36091623a3c246aa72eb0123ee8a48fe59c4e6eedc6a

  • SSDEEP

    6144:YDthOzj8hzKNHldObmwhcxobwdSgLI2XC:YJkE8EhcxobEVS

Malware Config

Targets

    • Target

      15f2a4a7c858748411065c202297600b073a72671eaa30ba590c2eb4a437172d

    • Size

      315KB

    • MD5

      9ce1254637bf6e6ffc142e6bb7bfad96

    • SHA1

      a9ac0f6b9cced4c39fd9839bc6b28d78fe014d55

    • SHA256

      15f2a4a7c858748411065c202297600b073a72671eaa30ba590c2eb4a437172d

    • SHA512

      d1f291fcbb8244a3f8c03a4d20d770c554dd7e0b72fe2ec0e66b62a0afd140006db417b67785aee5bffc36091623a3c246aa72eb0123ee8a48fe59c4e6eedc6a

    • SSDEEP

      6144:YDthOzj8hzKNHldObmwhcxobwdSgLI2XC:YJkE8EhcxobEVS

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks