General

  • Target

    fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe

  • Size

    583KB

  • Sample

    240913-cesnjaxhnn

  • MD5

    d6f99a0cc11e32ea897bc97a319748ab

  • SHA1

    006a848fd606c3799ef9ec23ff47fbb81900bc74

  • SHA256

    fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409

  • SHA512

    dc1af6b89f41a83d9eb84304fb1e9dff8e62de312f6c1245f1d0850bebd0596ab99e3548df6b36d9db7bb953882c745ee8a94cc4a9258b447fc5dec0ffa9b621

  • SSDEEP

    12288:TXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FY/Hd2sQIsXSBBCWENB:6hloDX0XOf4Kd2EsCjCW+B

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409.exe

    • Size

      583KB

    • MD5

      d6f99a0cc11e32ea897bc97a319748ab

    • SHA1

      006a848fd606c3799ef9ec23ff47fbb81900bc74

    • SHA256

      fd9725ecc7ed625c2174660e7f51f647fff9474f4c21c8ed84e0608bbcc5a409

    • SHA512

      dc1af6b89f41a83d9eb84304fb1e9dff8e62de312f6c1245f1d0850bebd0596ab99e3548df6b36d9db7bb953882c745ee8a94cc4a9258b447fc5dec0ffa9b621

    • SSDEEP

      12288:TXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FY/Hd2sQIsXSBBCWENB:6hloDX0XOf4Kd2EsCjCW+B

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks