General

  • Target

    afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

  • Size

    1.2MB

  • Sample

    240619-cxtzbasckh

  • MD5

    f58362efd1e0550977db29a3ff4bed49

  • SHA1

    bd239b22805c2d9ead09712ab9060e4869564326

  • SHA256

    afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

  • SHA512

    c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7

  • SSDEEP

    12288:/Vqi8tTaU9nxYoWo51/QZtAAm5WzgNYTpuXA1OV8nQwh6DYcN8Ezs/mO0Wh1Q2:CbnKoWt6AzqQNnhsYcN8j0Whx

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

    • Size

      1.2MB

    • MD5

      f58362efd1e0550977db29a3ff4bed49

    • SHA1

      bd239b22805c2d9ead09712ab9060e4869564326

    • SHA256

      afb3133b41e483edcab5987c4a98047cddcec5daf4a3b42d02e402a3af27c977

    • SHA512

      c14399acb2ee2efbe9487f3f3e18e28b2f97e3c7df0a77c124be12629c1646a21f75749168bdf13b1365756e80a91a77cde4443dd7611353115c7578d62c71b7

    • SSDEEP

      12288:/Vqi8tTaU9nxYoWo51/QZtAAm5WzgNYTpuXA1OV8nQwh6DYcN8Ezs/mO0Wh1Q2:CbnKoWt6AzqQNnhsYcN8j0Whx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks