General

  • Target

    caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033

  • Size

    915KB

  • Sample

    240604-bywnvshd64

  • MD5

    17746c920e5fc164751053c56ae4ad3f

  • SHA1

    6d608752627347d0d061cee5c2b3c15eecf9b8ff

  • SHA256

    caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033

  • SHA512

    749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629

  • SSDEEP

    12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://edalatianco.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    PLAYBOY@123

Targets

    • Target

      caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033

    • Size

      915KB

    • MD5

      17746c920e5fc164751053c56ae4ad3f

    • SHA1

      6d608752627347d0d061cee5c2b3c15eecf9b8ff

    • SHA256

      caa2f58aaa8d47fefd6576268bded1cc8a5a834ce372b1bc0c32aaf1f3cc8033

    • SHA512

      749baa6fbd66628c00ea55030ffaf80ee9dcd86ca28fd0c3b4c6c46500a31df85c4813e273193e6a133f90e22ce4d45d8cf2fd8b65f7545054005c0aaac1b629

    • SSDEEP

      12288:ohX0D9CQStfAheg7w2PUXWkdzyeNaoURCReJKv0+OOt8PYuTBL2s7k78mqS7Dd/c:K0DUY7TsfdHaoUR818CyPYKjmqS/Ql

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks