General
-
Target
scanned cheque.exe
-
Size
600KB
-
Sample
200707-yrhkyasbfx
-
MD5
c1dc3115fb5af29c1cedcc7cbc953d18
-
SHA1
b29642207ad240e066f3e31ea02ba2093f914ec9
-
SHA256
b55e856692daa6a9b51b3e8e5ca4ef2d78721fabd66d99b181509736a36d0c72
-
SHA512
1888baf5533bf91c232e35f7d9687a755f0846f0964cd15a215628d4e0ea6fd04bf14dac0f871de6158b33a085198da96492be3b43382b33a576ecb0d6b47c85
Static task
static1
Behavioral task
behavioral1
Sample
scanned cheque.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
scanned cheque.exe
Resource
win10
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ciftci.com.tr - Port:
21 - Username:
[email protected] - Password:
Idonhammer2#
Targets
-
-
Target
scanned cheque.exe
-
Size
600KB
-
MD5
c1dc3115fb5af29c1cedcc7cbc953d18
-
SHA1
b29642207ad240e066f3e31ea02ba2093f914ec9
-
SHA256
b55e856692daa6a9b51b3e8e5ca4ef2d78721fabd66d99b181509736a36d0c72
-
SHA512
1888baf5533bf91c232e35f7d9687a755f0846f0964cd15a215628d4e0ea6fd04bf14dac0f871de6158b33a085198da96492be3b43382b33a576ecb0d6b47c85
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-