General

  • Target

    c4e9963d13348a68742fdfb05d1b686849581899f7db23870c560f10dc3ba05a

  • Size

    649KB

  • Sample

    240602-bhxafsde7x

  • MD5

    fa12168225a10aaa5e01b15d8ea7dbd5

  • SHA1

    a4edc4cfb13bcd1de0863e255b81b57f1972410c

  • SHA256

    c4e9963d13348a68742fdfb05d1b686849581899f7db23870c560f10dc3ba05a

  • SHA512

    1e6299aa4b8c586ddb0b92a4136e737528b4fe6e5c300b0395596b5b6e0009d429eddb90183e04222b8a435cb9a47397a672c62a2fc2c490fcd245438467bec5

  • SSDEEP

    12288:FXgtvRchavhpeCOYp0/OASjZndhz+syZsRLFeNR2pI9QJPfekWb2zN7K9M:OtNgYnpdJeIFene/WCztK9M

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      STATEMENT OF ACCOUNT.exe

    • Size

      678KB

    • MD5

      a6860f38da5460092e32e7d3ad40d73b

    • SHA1

      35105d4db8c8e4953741b45b66b7dda4557e4513

    • SHA256

      364c37d1a5142ecaaeabce403a7809a109348f94afd4fc547d862ed9b0f83bee

    • SHA512

      c3c12ce308ddbcf215ddab0d1d5b3ff25ae963d0024d93bfd7e807b7a1bbf6b239f206ba007ea9bf512837608fd658a3994bc91d993f3204e25178ada0783116

    • SSDEEP

      12288:av3XNuRchUsEcC8Yps/OACjZndhizPiI7vylo9QJHfekWb2DPR07kR:cEsZY5pdQxvvI/WCDz

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks