General
-
Target
Tracking No_SINI0068206497.exe
-
Size
727KB
-
Sample
200707-9s5nqmlkcs
-
MD5
3b35b332a3a1320af5cb2ad9d437b019
-
SHA1
2ae2b6de1e083518ca9190b82f95eee9d03adb1d
-
SHA256
cb5dbe33a332786035666cd1835ba227c148ff023d7a3d98460d93edf3906f6e
-
SHA512
2f493936558bb348dac863a659e154559122c115e85e47080ffe616778177d849496908d85051fd8263e817489fc1a172c85e3655c3f97631c511224e9c261af
Static task
static1
Behavioral task
behavioral1
Sample
Tracking No_SINI0068206497.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Tracking No_SINI0068206497.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
udehanyim@11
Targets
-
-
Target
Tracking No_SINI0068206497.exe
-
Size
727KB
-
MD5
3b35b332a3a1320af5cb2ad9d437b019
-
SHA1
2ae2b6de1e083518ca9190b82f95eee9d03adb1d
-
SHA256
cb5dbe33a332786035666cd1835ba227c148ff023d7a3d98460d93edf3906f6e
-
SHA512
2f493936558bb348dac863a659e154559122c115e85e47080ffe616778177d849496908d85051fd8263e817489fc1a172c85e3655c3f97631c511224e9c261af
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-