General

  • Target

    8e280c86100e21e4edc3e5f9b953482bafd65a8f05fdb3e89b150e92a6d6aa5b

  • Size

    1.4MB

  • Sample

    240604-by1b2shd68

  • MD5

    e43e3db18041b206b5bd174ed071805b

  • SHA1

    a9c8afc81d0e20fb087a67ba8f7b029eb4e56cd4

  • SHA256

    8e280c86100e21e4edc3e5f9b953482bafd65a8f05fdb3e89b150e92a6d6aa5b

  • SHA512

    9104cb6d4b2c566c00dd1dceaa934771ace30b79a9611f668e5a3fbc08cd6b5bb82c52701b5379127481272311589065daaa2948fe5a2f51c59c334dd15d534e

  • SSDEEP

    12288:hhX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:b0DUY7TsfdHaoUR818CyPYKjmqS/Ql

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://edalatianco.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    PLAYBOY@123

Targets

    • Target

      Delivery Note_pdf.exe

    • Size

      915KB

    • MD5

      17746c920e5fc164751053c56ae4ad3f

    • SHA1

      6d608752627347d0d061cee5c2b3c15eecf9b8ff

    • SHA256

      caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033

    • SHA512

      749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629

    • SSDEEP

      12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks