General

  • Target

    b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3.exe

  • Size

    714KB

  • Sample

    240913-qyjfvstamb

  • MD5

    21951471cfc7c9beee8e3768e5a7665d

  • SHA1

    9de3b9262f971589fa4c50959aee765919886184

  • SHA256

    b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3

  • SHA512

    e003272c18574d0664bb31d0ddb4bc98677ec7b1971f0ddff350cabd355a2411b95ac1f26e2f21d2e1fd1241ff7a070fe446325d83a9267ccf1cd97de7020e58

  • SSDEEP

    12288:oeO6upxZF7RRfNBXyc8NTh0O0O0gui03jcntzLYBViwt5XH/kR:DupTXhClT0Ni03YnJY7iw5q

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3.exe

    • Size

      714KB

    • MD5

      21951471cfc7c9beee8e3768e5a7665d

    • SHA1

      9de3b9262f971589fa4c50959aee765919886184

    • SHA256

      b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3

    • SHA512

      e003272c18574d0664bb31d0ddb4bc98677ec7b1971f0ddff350cabd355a2411b95ac1f26e2f21d2e1fd1241ff7a070fe446325d83a9267ccf1cd97de7020e58

    • SSDEEP

      12288:oeO6upxZF7RRfNBXyc8NTh0O0O0gui03jcntzLYBViwt5XH/kR:DupTXhClT0Ni03YnJY7iw5q

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks