General

  • Target

    35931dde3f9e60ae4cbf22e5348bc4afca8d6145137a27a25216edba8b66f68e

  • Size

    559KB

  • Sample

    241222-bna96sxld1

  • MD5

    db18c7473665c8c3c28abef8107ac4e8

  • SHA1

    ac8826df8832d3cf3825d1523f5d605c9ff22ea6

  • SHA256

    35931dde3f9e60ae4cbf22e5348bc4afca8d6145137a27a25216edba8b66f68e

  • SHA512

    a44f2dec7dec52ed499c7a05dee8960c390a168f82531d13371f45d0e6185fe9e6c99fb384e827b9d087756109c6bb0d2697d2b097e0bfdb193a064e0022b8d0

  • SSDEEP

    12288:B9BvctM85t35JPNJj2WzoRLQYRYzmYhnc9skqXatMdJ8s8:BD0tM85tbNJjldeYiYhncGZqtoJ89

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      35931dde3f9e60ae4cbf22e5348bc4afca8d6145137a27a25216edba8b66f68e

    • Size

      559KB

    • MD5

      db18c7473665c8c3c28abef8107ac4e8

    • SHA1

      ac8826df8832d3cf3825d1523f5d605c9ff22ea6

    • SHA256

      35931dde3f9e60ae4cbf22e5348bc4afca8d6145137a27a25216edba8b66f68e

    • SHA512

      a44f2dec7dec52ed499c7a05dee8960c390a168f82531d13371f45d0e6185fe9e6c99fb384e827b9d087756109c6bb0d2697d2b097e0bfdb193a064e0022b8d0

    • SSDEEP

      12288:B9BvctM85t35JPNJj2WzoRLQYRYzmYhnc9skqXatMdJ8s8:BD0tM85tbNJjldeYiYhncGZqtoJ89

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks