General

  • Target

    Purchase order (2).exe

  • Size

    1.0MB

  • Sample

    240618-janbkstakb

  • MD5

    968e02a095413348de99f2044213505a

  • SHA1

    1c181d224fb48a7351370c525bbff9cca0380200

  • SHA256

    631d62fd42b300f67847a6de30a21a7821abdc328491e0565f67bd1f879f9522

  • SHA512

    fca992251073d992f93ef5da97b048d9e2fb8473fc0306d9e735e52a7ee852b4f1547acdb576ea26b85cdc623aed8807295095da18a211f747f637b33e25bd77

  • SSDEEP

    24576:/AHnh+eWsN3skA4RV1Hom2KXMmHawgphnuN0DhbKqFbYp6V5:ih+ZkldoPK8YawouuFkpw

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Purchase order (2).exe

    • Size

      1.0MB

    • MD5

      968e02a095413348de99f2044213505a

    • SHA1

      1c181d224fb48a7351370c525bbff9cca0380200

    • SHA256

      631d62fd42b300f67847a6de30a21a7821abdc328491e0565f67bd1f879f9522

    • SHA512

      fca992251073d992f93ef5da97b048d9e2fb8473fc0306d9e735e52a7ee852b4f1547acdb576ea26b85cdc623aed8807295095da18a211f747f637b33e25bd77

    • SSDEEP

      24576:/AHnh+eWsN3skA4RV1Hom2KXMmHawgphnuN0DhbKqFbYp6V5:ih+ZkldoPK8YawouuFkpw

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks