General

  • Target

    0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d.exe

  • Size

    937KB

  • Sample

    241122-chvmassjg1

  • MD5

    adc8d552e00251dbbdcd0aafe5bd3739

  • SHA1

    bdccf1531860ea4e5c139864707332252ca6d62b

  • SHA256

    0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d

  • SHA512

    4ab5eee11aec80b2894d51f1b666461e779a012e5bb94ac536366520c2e3bd9dbd5fe40685bd522697c1db94cbb19c7612c16e9fdb855eaa35338512ef62e680

  • SSDEEP

    12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d.exe

    • Size

      937KB

    • MD5

      adc8d552e00251dbbdcd0aafe5bd3739

    • SHA1

      bdccf1531860ea4e5c139864707332252ca6d62b

    • SHA256

      0b06f6a3a4102c27376f21cbcd09d3c0bf5e6cc7e92f9b9a3810fc386ac8184d

    • SHA512

      4ab5eee11aec80b2894d51f1b666461e779a012e5bb94ac536366520c2e3bd9dbd5fe40685bd522697c1db94cbb19c7612c16e9fdb855eaa35338512ef62e680

    • SSDEEP

      12288:drOn+Ri3AgFdmcdsjDbxl7qu4Q0eAxpqz4A501t5z7clqO65SAvzP0zoP7r9r/+l:pQ3AgNubfqK2pqz4/5Kq3Co1q

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks