General

  • Target

    ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

  • Size

    1.1MB

  • Sample

    250124-bmg2bstphp

  • MD5

    3bf36f75ae271a827541f9bb64bbab51

  • SHA1

    368038436abc04b3409d2ea11687b49145665542

  • SHA256

    ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

  • SHA512

    17a5c19c91775d6ecb544fff101f79b71e828cd48857dc1659e64f2dbd0e4457ebaf08edde049592ede2d2e559a789d3aa55d9b260e240714094649eee93157c

  • SSDEEP

    24576:/RmJkcoQricOIQxiZY1WNy/IFFq3h+640rSTkDs7n:UJZoQrbTFZY1WNyaSwGDM

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    cMhKDQUk1{;%

Targets

    • Target

      ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

    • Size

      1.1MB

    • MD5

      3bf36f75ae271a827541f9bb64bbab51

    • SHA1

      368038436abc04b3409d2ea11687b49145665542

    • SHA256

      ccd4e5cdda6875a7effac7e69995f3fd6cc0f39adb5fbbc5138aed35c54d9920

    • SHA512

      17a5c19c91775d6ecb544fff101f79b71e828cd48857dc1659e64f2dbd0e4457ebaf08edde049592ede2d2e559a789d3aa55d9b260e240714094649eee93157c

    • SSDEEP

      24576:/RmJkcoQricOIQxiZY1WNy/IFFq3h+640rSTkDs7n:UJZoQrbTFZY1WNyaSwGDM

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks