General
-
Target
74725794.exe
-
Size
922KB
-
Sample
210115-flsfzfyye2
-
MD5
c8607d4c72e539cf5c53ad218c6fd849
-
SHA1
c8658c13d91c2a6f032eb16860adb59191e13e31
-
SHA256
612f4209c5776ebdc317cb52f192ce84f11502ae9fdcd5b959371d72a2082f2d
-
SHA512
bafb3d94d70cf55b034918099a7f41ef817792327227079ad0c2c4e88e390d9bdda4d19eb11ae6f33d31aada86bea20828033cf7523604c1b9740e45f7255ac7
Static task
static1
Behavioral task
behavioral1
Sample
74725794.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
74725794.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
eazi@gdaslc.com - Password:
mmm777
Targets
-
-
Target
74725794.exe
-
Size
922KB
-
MD5
c8607d4c72e539cf5c53ad218c6fd849
-
SHA1
c8658c13d91c2a6f032eb16860adb59191e13e31
-
SHA256
612f4209c5776ebdc317cb52f192ce84f11502ae9fdcd5b959371d72a2082f2d
-
SHA512
bafb3d94d70cf55b034918099a7f41ef817792327227079ad0c2c4e88e390d9bdda4d19eb11ae6f33d31aada86bea20828033cf7523604c1b9740e45f7255ac7
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-