General

  • Target

    b684bdb5c293cfc6701f028b9bf2fb38bec4e0971153b08dde0e00ebef082f59

  • Size

    523KB

  • Sample

    241218-bks1tawlbz

  • MD5

    8d0f4dcf801ff4c91b0fc7790ec60915

  • SHA1

    56caf62cf6f2f96aea6e9f3801e4793db762b592

  • SHA256

    b684bdb5c293cfc6701f028b9bf2fb38bec4e0971153b08dde0e00ebef082f59

  • SHA512

    ec6412cbb56b2ff2e129c05261b3f51245e11be50a3a0c78f6ad92f18386a7237211ac6f186399baf91f8a1af56e3401a30b3044ae3bf358588fef986890e2cf

  • SSDEEP

    12288:ILuKw4n1/KI8j9+610bCCgg6bxC5ENuVoUCHG8jtN4jVcE3g:ILuH4n1iIi6gHk5XoBHTrX

Malware Config

Targets

    • Target

      b684bdb5c293cfc6701f028b9bf2fb38bec4e0971153b08dde0e00ebef082f59

    • Size

      523KB

    • MD5

      8d0f4dcf801ff4c91b0fc7790ec60915

    • SHA1

      56caf62cf6f2f96aea6e9f3801e4793db762b592

    • SHA256

      b684bdb5c293cfc6701f028b9bf2fb38bec4e0971153b08dde0e00ebef082f59

    • SHA512

      ec6412cbb56b2ff2e129c05261b3f51245e11be50a3a0c78f6ad92f18386a7237211ac6f186399baf91f8a1af56e3401a30b3044ae3bf358588fef986890e2cf

    • SSDEEP

      12288:ILuKw4n1/KI8j9+610bCCgg6bxC5ENuVoUCHG8jtN4jVcE3g:ILuH4n1iIi6gHk5XoBHTrX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • AgentTesla payload

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks