General

  • Target

    16092024_1619_16092024_Arrival Notice.zip

  • Size

    1.0MB

  • Sample

    240916-tsx9lsxdrj

  • MD5

    722cf5920e9ceba453e623659e403975

  • SHA1

    cf07bbf2dbd8807c0867ebf11a9dfbf6af83cfd6

  • SHA256

    2234dcc40a14982484e7571bb65bba52abdcf6eb406774cd921eb9648767d256

  • SHA512

    cae68fce7c0b3222d3287bc4b04701a7fe773a90419cb3b804a93d8a46560f1e6407409e38128c8b9ef5a9256cabde2d34b3e395cfd77b5b7a4d2666734b1f3c

  • SSDEEP

    24576:RaoD2QT0dU1c6bkvBFOiOuVehxoIFE2UKqhN6Gco8qVKk:RBodU1c2kvmkehxdfUKqD6lo8gT

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Arrival Notice.exe

    • Size

      1.5MB

    • MD5

      0324d879405e1ccc8f081aa524ca969b

    • SHA1

      6fa210c37b26b25afc1c7a90cbef7da8f7f98d90

    • SHA256

      67a8b2077a1aa43d393b1f843e556fd030c13dbe7a0e041d41c86fe233bddb38

    • SHA512

      8ec78655b9efb28dfd0d184473515bc5636b0b1ceebe1a59d579988a3ce3164b338966478142d6562ee593d14b892003f0a7c960f5be6029d85fd6011b22f371

    • SSDEEP

      24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8apYE0uVyhx2IFEmUcWVNAOcocj3s:UTvC/MTQYxsWR7apYOyhx7DUcWPAtocb

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks