General

  • Target

    4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe

  • Size

    849KB

  • Sample

    240919-bnhn9atbla

  • MD5

    7e7122557d4dcc0e0e39031aeee97570

  • SHA1

    ca1d7c0bd2ae735caa8df2ec50f6afec92b6e565

  • SHA256

    4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34

  • SHA512

    4f74b2fa8f3b6b229c6b3f8c415536452a0501d1d3cda0fe77a9a3e9dde5ee41db44e072c584b9f8f2336b3214cde1a7a6e7d0dff9138212d16ae3aebd4fcf8e

  • SSDEEP

    12288:SKlllZcsZ6ahn6JZN08J734IAMdv2+p8HVzzuS+Q3czbWbtb+Ayt+1LmZ3K1K:DcmN6Jj0ibXv2+WD+Qeb0YAO+1W3K1K

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://inhanoi.net.vn
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ^TSt3!FK$UBA

Targets

    • Target

      4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34.exe

    • Size

      849KB

    • MD5

      7e7122557d4dcc0e0e39031aeee97570

    • SHA1

      ca1d7c0bd2ae735caa8df2ec50f6afec92b6e565

    • SHA256

      4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34

    • SHA512

      4f74b2fa8f3b6b229c6b3f8c415536452a0501d1d3cda0fe77a9a3e9dde5ee41db44e072c584b9f8f2336b3214cde1a7a6e7d0dff9138212d16ae3aebd4fcf8e

    • SSDEEP

      12288:SKlllZcsZ6ahn6JZN08J734IAMdv2+p8HVzzuS+Q3czbWbtb+Ayt+1LmZ3K1K:DcmN6Jj0ibXv2+WD+Qeb0YAO+1W3K1K

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks