General

  • Target

    dc9010200032b754957faab28433a846b9aa1d7d52b20d1a12638d9f9f326790.exe

  • Size

    1.3MB

  • Sample

    240910-crt25ascpp

  • MD5

    939f5149d00580a35e3555c920d6b371

  • SHA1

    ab2ae828c3ab94393304690b94019bd7cd054037

  • SHA256

    dc9010200032b754957faab28433a846b9aa1d7d52b20d1a12638d9f9f326790

  • SHA512

    af7ceab90fc2a1371e51f3734c6df3d9997bb2de06c86a98f195ce68e4453cc879cb69abce8a221be866931422537400a9ad667cc71a07a8e5ebfaf8c3dff05c

  • SSDEEP

    24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aMULnSIYsqFxyTwagdP5aY:1TvC/MTQYxsWR7aMUbAt4wB

Malware Config

Targets

    • Target

      dc9010200032b754957faab28433a846b9aa1d7d52b20d1a12638d9f9f326790.exe

    • Size

      1.3MB

    • MD5

      939f5149d00580a35e3555c920d6b371

    • SHA1

      ab2ae828c3ab94393304690b94019bd7cd054037

    • SHA256

      dc9010200032b754957faab28433a846b9aa1d7d52b20d1a12638d9f9f326790

    • SHA512

      af7ceab90fc2a1371e51f3734c6df3d9997bb2de06c86a98f195ce68e4453cc879cb69abce8a221be866931422537400a9ad667cc71a07a8e5ebfaf8c3dff05c

    • SSDEEP

      24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aMULnSIYsqFxyTwagdP5aY:1TvC/MTQYxsWR7aMUbAt4wB

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks