General

  • Target

    Quote_220072.exe

  • Size

    1.1MB

  • Sample

    241101-nlz7qsylft

  • MD5

    ac900546c8bf5b3be3184502d0d2d7ba

  • SHA1

    6427b2e160082bdb6a5b0213a3de348986f31530

  • SHA256

    23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

  • SHA512

    4b6bcd3c9413177629668f37160372b65c598a4c5c2ab7eae0905074761e49105b6e954fcfdccae11501120fba4a2dd59d477eab76911a6dd94e184bd7afeb56

  • SSDEEP

    24576:T4nhDoAFBOCmg1OJnkFWsksVBNF/ZNXLGQ7WczkxFnfbP97:T+hkcOCm+OWFW+V5BNXKQKczgt

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Quote_220072.exe

    • Size

      1.1MB

    • MD5

      ac900546c8bf5b3be3184502d0d2d7ba

    • SHA1

      6427b2e160082bdb6a5b0213a3de348986f31530

    • SHA256

      23df64fa762b5942d08dc6bf6f5afc75fc932519a96070af492e237b5483747f

    • SHA512

      4b6bcd3c9413177629668f37160372b65c598a4c5c2ab7eae0905074761e49105b6e954fcfdccae11501120fba4a2dd59d477eab76911a6dd94e184bd7afeb56

    • SSDEEP

      24576:T4nhDoAFBOCmg1OJnkFWsksVBNF/ZNXLGQ7WczkxFnfbP97:T+hkcOCm+OWFW+V5BNXKQKczgt

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Guloader family

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d6f54d2cefdf58836805796f55bfc846

    • SHA1

      b980addc1a755b968dd5799179d3b4f1c2de9d2d

    • SHA256

      f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    • SHA512

      ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

    • SSDEEP

      192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks