General

  • Target

    d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c

  • Size

    683KB

  • Sample

    241115-cf2ylawlhx

  • MD5

    c75e23e42ef5a5df0c9e6a3dac5b6288

  • SHA1

    7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d

  • SHA256

    d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c

  • SHA512

    cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399

  • SSDEEP

    12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c

    • Size

      683KB

    • MD5

      c75e23e42ef5a5df0c9e6a3dac5b6288

    • SHA1

      7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d

    • SHA256

      d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c

    • SHA512

      cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399

    • SSDEEP

      12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks