General
- Target PO-677763783-sn-997588983y3.exe
- Size 511KB
- Sample201109-5a6e6t42js
- SHA256 bca4bb062bec354c21f07300bca545b706478e056b3bb71f3ce41fdb589a26a5
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.aydangroup.com.my/
-
Port
21
-
Username
-
Password
^l@2~))DQq,z
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.aydangroup.com.my/
-
Port
21
-
Username
-
Password
^l@2~))DQq,z
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.aydangroup.com.my
-
Port
21
-
Username
-
Password
^l@2~))DQq,z
Targets
-
- Target PO-677763783-sn-997588983y3.exe
- Size 511KB
- SHA256 bca4bb062bec354c21f07300bca545b706478e056b3bb71f3ce41fdb589a26a5
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext