General

  • Target

    3c438ad2e2a2b95ee3033bb4ebafc1a1f80e0e7ee6adc3087bb384ccd0b95838.exe

  • Size

    2.3MB

  • Sample

    240612-bpdfxsxemj

  • MD5

    a4f3ea8f5192bb452fd56f3176aa7b58

  • SHA1

    7dfeffabfda07251e2da9281c640098fcd1eb629

  • SHA256

    3c438ad2e2a2b95ee3033bb4ebafc1a1f80e0e7ee6adc3087bb384ccd0b95838

  • SHA512

    f8dbed0a73fbb6e68e7d7ed25aa34b011da9dfa713f412d8c41ac49f7e3073b4533b0329cfc678ec6039ec098e222dc8378566142d6f872638f8899158890f45

  • SSDEEP

    3072:rnJXHlRdbXJwJyXI7BTLu0tLNFsU/BRN1NBb4NASWOcPDqnk98peFTBSfqKv7r+f:rnJXD

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      3c438ad2e2a2b95ee3033bb4ebafc1a1f80e0e7ee6adc3087bb384ccd0b95838.exe

    • Size

      2.3MB

    • MD5

      a4f3ea8f5192bb452fd56f3176aa7b58

    • SHA1

      7dfeffabfda07251e2da9281c640098fcd1eb629

    • SHA256

      3c438ad2e2a2b95ee3033bb4ebafc1a1f80e0e7ee6adc3087bb384ccd0b95838

    • SHA512

      f8dbed0a73fbb6e68e7d7ed25aa34b011da9dfa713f412d8c41ac49f7e3073b4533b0329cfc678ec6039ec098e222dc8378566142d6f872638f8899158890f45

    • SSDEEP

      3072:rnJXHlRdbXJwJyXI7BTLu0tLNFsU/BRN1NBb4NASWOcPDqnk98peFTBSfqKv7r+f:rnJXD

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables packed with or use KoiVM

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks