General

  • Target

    18b7930562b9f73f383204f2a09e2a76ab3d772a0d3813ea42bbff257430b5ad

  • Size

    966KB

  • Sample

    241217-bg6shawphl

  • MD5

    28ea8e92608217ac405a71e3388eeee2

  • SHA1

    be3864ac322abd6ffeeb7308011ac5b3f733e561

  • SHA256

    18b7930562b9f73f383204f2a09e2a76ab3d772a0d3813ea42bbff257430b5ad

  • SHA512

    86cfa75ec43a3bdb0960a2f53452a1ce41e93c1b598bdbc2239aae833bbab8d98cad6d707b684d27aea6a46906d46c016df79117300292ced99cf024e19bdab2

  • SSDEEP

    24576:5fmMv6Ckr7Mny5QtMGjIch4Ks9T1+TKJy:53v+7/5QtMi4KwXk

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      18b7930562b9f73f383204f2a09e2a76ab3d772a0d3813ea42bbff257430b5ad

    • Size

      966KB

    • MD5

      28ea8e92608217ac405a71e3388eeee2

    • SHA1

      be3864ac322abd6ffeeb7308011ac5b3f733e561

    • SHA256

      18b7930562b9f73f383204f2a09e2a76ab3d772a0d3813ea42bbff257430b5ad

    • SHA512

      86cfa75ec43a3bdb0960a2f53452a1ce41e93c1b598bdbc2239aae833bbab8d98cad6d707b684d27aea6a46906d46c016df79117300292ced99cf024e19bdab2

    • SSDEEP

      24576:5fmMv6Ckr7Mny5QtMGjIch4Ks9T1+TKJy:53v+7/5QtMi4KwXk

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks