General

  • Target

    30052024_1351_27052024_PI-236031.rar

  • Size

    522KB

  • Sample

    240530-q57f9sag6t

  • MD5

    43ba3abf99d3918987d5bdc4ea0a20ba

  • SHA1

    4ab0701f1f9f2cad6236f27f27854d89b9d494a9

  • SHA256

    544900b78d980d88152cf5f4a6fc92a3752e30890cd2373593b3769f698e07ac

  • SHA512

    f098b4cf470e119e3a4ef0dd898aa63154428ebd3a5a91bf6f47b7b740ac76c31b71aa62d283852f2ea590a018626b3ba1f385b03b18837ea116cb189ab9f955

  • SSDEEP

    12288:9ZvABoF/oa6Xh0uhG5l2GBx2CXDUIBPYYhu9NZT/YzOIK/3o0:3Ik/o/Xh095l2u4UIQgPNZTATq

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (=8fPSH$KO_!

Targets

    • Target

      PI-236031.exe

    • Size

      1013KB

    • MD5

      05d95a552838cb5c6d45a79473c9f430

    • SHA1

      535c4d854628081163b1da1afdea892204a88eef

    • SHA256

      9f8325d8345d383ed22e18f47303b03947c1e652ad304b7ca88a270355eb8f4d

    • SHA512

      4bab7d8da8541f46b7b048838f02c6d7a3408fe4615970375024fc7986bf2dbd790358a4aa2d68deb3a7ebdb4ab55b0bba85b54b390c695da7c645918f3d414c

    • SSDEEP

      24576:OAHnh+eWsN3skA4RV1Hom2KXMmHauvhieQkXRGQ5:5h+ZkldoPK8YauikX/

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks