General

  • Target

    5c6bd84aa0d5aa14ac98f583b3bc53ec09d433c6261b4c6dabcfac4e44aa802f.zip

  • Size

    617KB

  • Sample

    240618-vkmctawfqq

  • MD5

    1649cee761d5d458246fb9d77280ace5

  • SHA1

    90c52127bf3cfd025693299c5fcfff6f4877d716

  • SHA256

    5c6bd84aa0d5aa14ac98f583b3bc53ec09d433c6261b4c6dabcfac4e44aa802f

  • SHA512

    32440cfac5941ee4fb8d67f27afa92f09926ff9a11f06e0d813db51e3f43b46d50e0b8f769695df2c30514052f2923da0ed6c13f2edd0997288af333101a0cb4

  • SSDEEP

    12288:VC5k8c5cG/QwOVasP1WoX2DaKZ6IqeUgGIGYlAPwjGPvqyeh6ILfzOWDNafksCfR:VGc+m8VFP1WsugI/GI7APw8VIzzrxAk3

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      FACTURA09654700.BAT

    • Size

      1.0MB

    • MD5

      aed00ff3e85dbf1bbf99939966939b3a

    • SHA1

      d02a5bc420207a7958e34a4740968439969f5b19

    • SHA256

      b772162c5b510c5427be045abfdc43c29756217e2ed924ce4c4388bd457a4987

    • SHA512

      08ad4f11a67a9e8228d83e96fbcccd98910d53ff2929e2d70d336b8e808d4d7e37f90d157e2747b744eb19b451aba2a0985022207a68ff50dcbd8cdef5e1f50a

    • SSDEEP

      24576:HAHnh+eWsN3skA4RV1Hom2KXMmHauOVaz7jxokZf4vFEGR5:6h+ZkldoPK8YauOIzHxokZfqFEo

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks