General

  • Target

    Chaser Temp CRACKED.zip

  • Size

    4.5MB

  • Sample

    240903-mslggsvamm

  • MD5

    110ef86686ba4be41314e43de2462cd8

  • SHA1

    3b9e33319f8693d32ac3fe1a0a75b0afb478de1a

  • SHA256

    c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7

  • SHA512

    e5d94bbb8fe50f03391bf37c609d015d4653f1c055c4d15cd93a7ed167271afd3a08530be73d6d62198970e49c2909bff9345ffeff122f313494fcf5f56921ee

  • SSDEEP

    98304:D8JQ9csmb+XU5lemYidFoJjNKdSkGa72mqE2mTgbNJNLzxQcgwH382I/nnD:D8JQWFb5ThvouAbBDnDgi82IfD

Malware Config

Targets

    • Target

      Chaser Temp CRACKED.zip

    • Size

      4.5MB

    • MD5

      110ef86686ba4be41314e43de2462cd8

    • SHA1

      3b9e33319f8693d32ac3fe1a0a75b0afb478de1a

    • SHA256

      c037429f30412b9308880840a0a5ee836ddd685e1af97c67853fed62308516c7

    • SHA512

      e5d94bbb8fe50f03391bf37c609d015d4653f1c055c4d15cd93a7ed167271afd3a08530be73d6d62198970e49c2909bff9345ffeff122f313494fcf5f56921ee

    • SSDEEP

      98304:D8JQ9csmb+XU5lemYidFoJjNKdSkGa72mqE2mTgbNJNLzxQcgwH382I/nnD:D8JQWFb5ThvouAbBDnDgi82IfD

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks