General

  • Target

    QUOTATION_JUNQTRA031244ْPDF.scr.exe

  • Size

    229KB

  • Sample

    240625-mzjapsvgnf

  • MD5

    2c1e0efc6418024762f027dc4e494c3b

  • SHA1

    e72bd9a7c92f677f213d33a7fbdaa6753daf3fee

  • SHA256

    22a470a3ce48f860bd58041630bd2914163e21a56c8c5292072edd1d9394416d

  • SHA512

    2d0fdb10abb9d22bc20fd9dd80adc19ec97efa2c995427814674a562a169ed2ab9df75d24c881d8945313aef1b43e26ce5618f97fba24457a271524a8ee1efb0

  • SSDEEP

    6144:WKE08tYLyZZEXrdm4Vz0Rpppppppppppppppppppppppppppppb:WK9Xrdm4Vz0RpppppppppppppppppppX

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      QUOTATION_JUNQTRA031244ْPDF.scr.exe

    • Size

      229KB

    • MD5

      2c1e0efc6418024762f027dc4e494c3b

    • SHA1

      e72bd9a7c92f677f213d33a7fbdaa6753daf3fee

    • SHA256

      22a470a3ce48f860bd58041630bd2914163e21a56c8c5292072edd1d9394416d

    • SHA512

      2d0fdb10abb9d22bc20fd9dd80adc19ec97efa2c995427814674a562a169ed2ab9df75d24c881d8945313aef1b43e26ce5618f97fba24457a271524a8ee1efb0

    • SSDEEP

      6144:WKE08tYLyZZEXrdm4Vz0Rpppppppppppppppppppppppppppppb:WK9Xrdm4Vz0RpppppppppppppppppppX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks