General

  • Target

    13092024_0359_12092024_Updated Pricelist.zip

  • Size

    558KB

  • Sample

    240913-eke1qstalq

  • MD5

    565253944a0334a3ed30965ac40b122d

  • SHA1

    622d3279670ea94fcf447ea6d079ee5a9f322464

  • SHA256

    806cbee363ff7d82d024af77bb4e34491faf16c344cd6f21e4ced84ec8ba6450

  • SHA512

    578dce2fa2ad449b4de98fb92ae41fa2880b51a3e3d4d3f629ad18146fc25d9632e23ad9a8e75cddd790d24839709bb69dfc6f06a7ffd33a923dc3cea4594045

  • SSDEEP

    12288:MCi9eMiU0vDNjPHUxhTeTNBIc5vcn+2mdVl4ve6N2vn+18h2yI8HMsS0+S:5M0NeeTNqucnjIVlQufhXI8HMPS

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Updated Pricelist.exe

    • Size

      583KB

    • MD5

      bd50b8389578702100c55e976e636d2c

    • SHA1

      04a8de3509219f30312a372dd365a84a2f853efe

    • SHA256

      317d4b1683e217b6af80de147bbeb8581255f320dd11ca5c13b0796f837d42aa

    • SHA512

      2ba298f9f2ddfac90aefd6587749f65002495bb3a8e7f7e5947ca7b7f654133329ca0ac9b69aae7c631155f6f865e4503350df6612c965fd22b3017d4d6e9543

    • SSDEEP

      12288:LXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FfCvz+1YhOyIIHMsulkf:ShloDX0XOf4oZhfIIHMgf

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks