General

  • Target

    92af4c638db9b8b9089151ba1b45e8fcfdddc73b679a30ed864164314e31d092

  • Size

    689KB

  • Sample

    240612-cgtnlsydjr

  • MD5

    8df00846f15494931d40fea77a717d18

  • SHA1

    5f9380e02209d1d71ca52659d3bf100ea95b9d1a

  • SHA256

    92af4c638db9b8b9089151ba1b45e8fcfdddc73b679a30ed864164314e31d092

  • SHA512

    2c6901ba1c2cbfcf8684cabec2963522ba825f80009c81b21669b8a7f54022ba3ad2bdbaf6a3f187f5329a6b5394d2d82f6926159fdb1d3f4a3576ff8f6e9e0f

  • SSDEEP

    12288:7frHtRIaTYxOp61EiR1R/lmKkJHdgaR1ZYcII0aXmJunV1rB9hkulJUS:7frHo0YYA1EiR7wwFa2ArB3koZ

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      RFQ - 026.exe

    • Size

      750KB

    • MD5

      28a4d4adbc0134107703cd1b2d800052

    • SHA1

      62c5a02ca9fc8ce570992f37a433ef5eb811eb98

    • SHA256

      a10341c58574b8a08c3f1469fadf00b14d93376e3cfe50d0799bac052462d170

    • SHA512

      0b672ba0cea136c277e65eee0b114dd9d4fdb4691d6194dec3c423e16bb3c687d0fd0890c99d8626b8d87a8eacaff9de0d2cfad316b89e43bdce2df84e5af548

    • SSDEEP

      12288:WHtZIA61Eix1//lmek//1ECz0mcMtOzGQRv2XMZACR5leZlN:WHEp1Eix9wbSeo6QRPZA+er

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks