General

  • Target

    Bestellung-Nr.24061189392.exe

  • Size

    917KB

  • Sample

    240625-m9f84awdla

  • MD5

    2fac53d4021b54c213978d42c3969f69

  • SHA1

    9f9fdbeba0d6b5552b79379f5223f8a835852b8e

  • SHA256

    79b65ff6fce04514c36a1bd5290f8a0d71646a9a634714cd3fa35f7c0f7835ce

  • SHA512

    694f6cd20b9255245edc4be0b900f7373e9969872da5c5920df97d9aaa25adc9643e70c50e6d3575e78009e8889de3d8168efeaf6d3c81a812604dc20692e17c

  • SSDEEP

    12288:9HGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:iRJSuMgl+JTP7QRJtD8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.rusticpensiune.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    hr,d@KUwa5llI%*RNL^J]g%8I;!;_Ne#G1h~lE!*86DAAD6#iLm$x)r+e1z$p+_Q,4_(f!};B?vD!IG?NqT[zOHNr6_nww[S]V?MlcYSt_QO

Targets

    • Target

      Bestellung-Nr.24061189392.exe

    • Size

      917KB

    • MD5

      2fac53d4021b54c213978d42c3969f69

    • SHA1

      9f9fdbeba0d6b5552b79379f5223f8a835852b8e

    • SHA256

      79b65ff6fce04514c36a1bd5290f8a0d71646a9a634714cd3fa35f7c0f7835ce

    • SHA512

      694f6cd20b9255245edc4be0b900f7373e9969872da5c5920df97d9aaa25adc9643e70c50e6d3575e78009e8889de3d8168efeaf6d3c81a812604dc20692e17c

    • SSDEEP

      12288:9HGT9ip/w75fpEWSuMtbWl+E7ZgTqDxNhkHTn7QCeHTISfpxrtD8:iRJSuMgl+JTP7QRJtD8

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks