General

  • Target

    da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a.7z

  • Size

    669KB

  • Sample

    240919-b8yafavcrp

  • MD5

    f7aff02f3542e92dd66f93b5e59dadcd

  • SHA1

    881e8d807561657f972e7c0fc36f946faf6cc10e

  • SHA256

    da41a1b5363b883fb13c819c595ead87b269dba1bfb51b8176669adcdfe49d8a

  • SHA512

    9a8aafd568fd3eab103f428d45b8afb44f50c37ea3bf7e0d6c8bf90eb20b965668e59c84f5efe70ced99dfb83729e4e416e5281fcc42448b9ddfc18f3b76a940

  • SSDEEP

    12288:Fjzkpx8txNxA0Phpiv6GFx3u3w/8DxukEf8uMe2HgkTU+OwFR7/hbd9bbt/3Sb:Fn6ufxhJcv5KgAa8u7+gkTUA/7pbd9vU

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Global e-Banking Payment Advice 000000164.exe

    • Size

      1.0MB

    • MD5

      bbec860047a8e57d464f8ca00ba3dd9e

    • SHA1

      25078f4b524446d73844952780b1c80750bc8fc7

    • SHA256

      617aad709ac7d66890968766cc4b21481d268624d5505963058e7fa10748a57c

    • SHA512

      a4a0ec4346bb59e39b571f3f058c5211222de0a93cbc570e05cefb5f951a2e44983001c6fd7cfe7ca2bb753fd88db2ae9d64aede2f541af669589db3346827ab

    • SSDEEP

      24576:8ctTx3fcFSvgIl5urL05mUyl7EbL9j1ui1q:FxvcmurAIEX11u

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks