General

  • Target

    8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca.exe

  • Size

    824KB

  • Sample

    241103-tfb6lsxlcy

  • MD5

    c15785eb484765d6eedc8443b08566e2

  • SHA1

    227b56145a9ad361621fa7197f6a4e4861426189

  • SHA256

    8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca

  • SHA512

    e5ed902c27d192dc088f80dbc3dd9937be12f64c8981e33f2fbd3fcd1c7b610da6fdb1b33d6b88180a8d8424ad0ddf9b241f67545405bd7c2029898affa0b9df

  • SSDEEP

    12288:YeYT18tQFWKDvedwHS1VxmYa7VSGQF1+qNlqTRNxLXPD/36cq6iTUO2X4:0RFbvedJzxmYaCFcqmRNxLXPLqWpX

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca.exe

    • Size

      824KB

    • MD5

      c15785eb484765d6eedc8443b08566e2

    • SHA1

      227b56145a9ad361621fa7197f6a4e4861426189

    • SHA256

      8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca

    • SHA512

      e5ed902c27d192dc088f80dbc3dd9937be12f64c8981e33f2fbd3fcd1c7b610da6fdb1b33d6b88180a8d8424ad0ddf9b241f67545405bd7c2029898affa0b9df

    • SSDEEP

      12288:YeYT18tQFWKDvedwHS1VxmYa7VSGQF1+qNlqTRNxLXPD/36cq6iTUO2X4:0RFbvedJzxmYaCFcqmRNxLXPLqWpX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks