General

  • Target

    95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe

  • Size

    35KB

  • Sample

    241222-lgfw7asrhr

  • MD5

    97e22a9d4aa0d4cfab11ec3af470a070

  • SHA1

    ef29a39d263de303cbf5daaaff90c557e4563b6e

  • SHA256

    95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19

  • SHA512

    8bc2b7e55f747e721e0d0c65d1f7b054af0a42ebb34d76ff1489820c46001e34a7889c77d8ab32255d9fd5a2181a5ba36920b7a9b91c5b893f805c299d1fc07f

  • SSDEEP

    384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

Malware Config

Targets

    • Target

      95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe

    • Size

      35KB

    • MD5

      97e22a9d4aa0d4cfab11ec3af470a070

    • SHA1

      ef29a39d263de303cbf5daaaff90c557e4563b6e

    • SHA256

      95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19

    • SHA512

      8bc2b7e55f747e721e0d0c65d1f7b054af0a42ebb34d76ff1489820c46001e34a7889c77d8ab32255d9fd5a2181a5ba36920b7a9b91c5b893f805c299d1fc07f

    • SSDEEP

      384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks