General
-
Target
totallyanonymous.com33.exe
-
Size
706KB
-
Sample
200529-6smlhvcr1n
-
MD5
acb0977d781054adc4c5d3a743eac607
-
SHA1
bc811960a7636a6856ed0218cad492fe094c4899
-
SHA256
429507366eda040b019369ecb0b5bfbda33fc0c23ec02ce46fef83c8bf4c0b15
-
SHA512
515448739a7450b9718991e81e8cc5b0ae5cbd27107ce4506e0263d8508f6da8dac7ed79d77e48f475ae56d3990615453c846ae450bf61154a06a84e755906fb
Static task
static1
Behavioral task
behavioral1
Sample
totallyanonymous.com33.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
totallyanonymous.com33.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
samuelson@totallyanonymous.com - Password:
186s509N
Targets
-
-
Target
totallyanonymous.com33.exe
-
Size
706KB
-
MD5
acb0977d781054adc4c5d3a743eac607
-
SHA1
bc811960a7636a6856ed0218cad492fe094c4899
-
SHA256
429507366eda040b019369ecb0b5bfbda33fc0c23ec02ce46fef83c8bf4c0b15
-
SHA512
515448739a7450b9718991e81e8cc5b0ae5cbd27107ce4506e0263d8508f6da8dac7ed79d77e48f475ae56d3990615453c846ae450bf61154a06a84e755906fb
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-