General

  • Target

    Scaaned_Products_Specifications‮sxlx..exe

  • Size

    1.6MB

  • Sample

    240625-ql79fsscnb

  • MD5

    68870c1548aaef1ebb33b4bc324a40f8

  • SHA1

    92b3d71abe0ce4d3afc5973a20456ac547fe5f60

  • SHA256

    5e7a31b88c9972678a7f64c36f42d7a0172e3f1672db3aeccc5c7e5c575524c0

  • SHA512

    86f8ec2ce556049810c4e404d71b1ecb246270c6dd69830a259aef3e46b240d3ebf725d0f48bd19648cd705c63d0fd67774f8e180bd1db93e2eade4eca388857

  • SSDEEP

    12288:iLsQXlH5DY6Co9q/KpByx0JW23URhqomgNo01La4MJ:iLsQX55DY6CaqiuxeeREovu0Nan

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.oserfech.eu
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Epicoffice@2024

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Scaaned_Products_Specifications‮sxlx..exe

    • Size

      1.6MB

    • MD5

      68870c1548aaef1ebb33b4bc324a40f8

    • SHA1

      92b3d71abe0ce4d3afc5973a20456ac547fe5f60

    • SHA256

      5e7a31b88c9972678a7f64c36f42d7a0172e3f1672db3aeccc5c7e5c575524c0

    • SHA512

      86f8ec2ce556049810c4e404d71b1ecb246270c6dd69830a259aef3e46b240d3ebf725d0f48bd19648cd705c63d0fd67774f8e180bd1db93e2eade4eca388857

    • SSDEEP

      12288:iLsQXlH5DY6Co9q/KpByx0JW23URhqomgNo01La4MJ:iLsQX55DY6CaqiuxeeREovu0Nan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks