General
-
Target
a9dadf707b3c20c1921151d4d8bc2a98.exe
-
Size
520KB
-
Sample
200711-fafpbrfb86
-
MD5
a9dadf707b3c20c1921151d4d8bc2a98
-
SHA1
efbf7491ae45132e2d3bd7ca92200c69e1644bc5
-
SHA256
a3009b66e611127884db7d845017ace8c556820e757e97993abc312b62a11ecd
-
SHA512
f6090f2014a9f298c8d8d593d8a61733159c28992d9d19c6d4e70afa46a42d1c5f39b689c708e59af9f91f3d85893521e7e086d589118f6662ccefac892e75d1
Static task
static1
Behavioral task
behavioral1
Sample
a9dadf707b3c20c1921151d4d8bc2a98.exe
Resource
win7
Behavioral task
behavioral2
Sample
a9dadf707b3c20c1921151d4d8bc2a98.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.skibokshotell.no/ - Port:
21 - Username:
[email protected] - Password:
DUcDxxNTn3@248
Protocol: ftp- Host:
ftp://ftp.skibokshotell.no/ - Port:
21 - Username:
[email protected] - Password:
DUcDxxNTn3@248
Targets
-
-
Target
a9dadf707b3c20c1921151d4d8bc2a98.exe
-
Size
520KB
-
MD5
a9dadf707b3c20c1921151d4d8bc2a98
-
SHA1
efbf7491ae45132e2d3bd7ca92200c69e1644bc5
-
SHA256
a3009b66e611127884db7d845017ace8c556820e757e97993abc312b62a11ecd
-
SHA512
f6090f2014a9f298c8d8d593d8a61733159c28992d9d19c6d4e70afa46a42d1c5f39b689c708e59af9f91f3d85893521e7e086d589118f6662ccefac892e75d1
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-