General

  • Target

    44982180a2b2da0d098ed9f5a932a38bdd7d0429229510db7296993cf26ed676

  • Size

    597KB

  • Sample

    241220-bhz2cavpcv

  • MD5

    a7b5c2693e1fc288c362703f349328a9

  • SHA1

    7d0528eea1bfca3a321e5af0d0a61f99659bdc89

  • SHA256

    44982180a2b2da0d098ed9f5a932a38bdd7d0429229510db7296993cf26ed676

  • SHA512

    90572edbdbc61e0e6c6d8272899b8301f3440247974c2a5cb41a9b11c60838e2230ce88a3c2c4ce9fc34bab23bc04fee24abd27eeb867481c777cc1b0408a5b1

  • SSDEEP

    12288:pV/R2pizgq7C329bvf+pn8KLCNlbmsoe/2+l6FrYqznRuYo+jUw:z/Rmizgq6UGvLimsovdFrY9yUw

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.alltoursegypt.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    OPldome23#12klein

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SKM_5890525167809.exe

    • Size

      1.1MB

    • MD5

      d1642b4a6a94d085fabfd70a2ac37deb

    • SHA1

      6c00daa9f86d1afcdfdb47cf3a4555eb242d5d21

    • SHA256

      0c7fc6fd424661d954ddf30325f8c98aed5b144cdf24a4197225d691be16f730

    • SHA512

      5d2e5645c943cc729a1daf24147a67334df9cdfddd90c693d5be606db255bfc131b4ddac6851e76404f0a0e32d8dc7417ee0521838fc81c72e562b413bc0f696

    • SSDEEP

      24576:OqDEvCTbMWu7rQYlBQcBiT6rprG8ag4mjRxL:OTvC/MTQYxsWR7agp9x

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks