General

  • Target

    2024-06-04_240af48b0056bf939726436ef834a2e8_megazord

  • Size

    3.1MB

  • Sample

    240604-a36h7aga26

  • MD5

    240af48b0056bf939726436ef834a2e8

  • SHA1

    c6296a588d14af7fcc8dedeee566790eeee2193f

  • SHA256

    724fd513b28f07121fc19f1adb2173365d55a988e6ac03992a04ca7a654a6c9c

  • SHA512

    4594427b57c16d5a8fe64cc07a706cdabfc3840a35a80c72813bcacbf4f8a16c40f56b2fc0da653432bfab8cee640b21dac079f94d669b60ca356d7d75aa887b

  • SSDEEP

    49152:u8yJAk206NICMq5pzKRgqVzKoYgFtRq3mfPi:ZBsa8P

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    terminal4.veeblehosting.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ifeanyi1987@

Targets

    • Target

      2024-06-04_240af48b0056bf939726436ef834a2e8_megazord

    • Size

      3.1MB

    • MD5

      240af48b0056bf939726436ef834a2e8

    • SHA1

      c6296a588d14af7fcc8dedeee566790eeee2193f

    • SHA256

      724fd513b28f07121fc19f1adb2173365d55a988e6ac03992a04ca7a654a6c9c

    • SHA512

      4594427b57c16d5a8fe64cc07a706cdabfc3840a35a80c72813bcacbf4f8a16c40f56b2fc0da653432bfab8cee640b21dac079f94d669b60ca356d7d75aa887b

    • SSDEEP

      49152:u8yJAk206NICMq5pzKRgqVzKoYgFtRq3mfPi:ZBsa8P

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks