General

  • Target

    Quotation.exe

  • Size

    1.1MB

  • Sample

    241111-mvkb7sybnj

  • MD5

    5bdcc2d33ca974c1d8448afcf83f74d1

  • SHA1

    f693dea01991d995173a5934d478ad43c50e28e2

  • SHA256

    4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b

  • SHA512

    35633187911d09542892a55671ce6d2953418466185b57aa506fabf039c97a7375c8ad4268f3ded8f9fe5bb7a36a3c688d2321056b7c0aff3546a630df30bbbf

  • SSDEEP

    24576:X4nhDoAFnNn+rb27TGQwpoxmBNFt/ZNXLGQ7WczkxFnfbP9:X+hkSNwbwGlym5tBNXKQKczg

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Quotation.exe

    • Size

      1.1MB

    • MD5

      5bdcc2d33ca974c1d8448afcf83f74d1

    • SHA1

      f693dea01991d995173a5934d478ad43c50e28e2

    • SHA256

      4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b

    • SHA512

      35633187911d09542892a55671ce6d2953418466185b57aa506fabf039c97a7375c8ad4268f3ded8f9fe5bb7a36a3c688d2321056b7c0aff3546a630df30bbbf

    • SSDEEP

      24576:X4nhDoAFnNn+rb27TGQwpoxmBNFt/ZNXLGQ7WczkxFnfbP9:X+hkSNwbwGlym5tBNXKQKczg

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d6f54d2cefdf58836805796f55bfc846

    • SHA1

      b980addc1a755b968dd5799179d3b4f1c2de9d2d

    • SHA256

      f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    • SHA512

      ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

    • SSDEEP

      192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks