General
-
Target
jKiL1mzTAVltJ30.exe
-
Size
1.1MB
-
Sample
210121-xxb4ev1aa2
-
MD5
75e6d9d24a6366383f3315536f9ee1a3
-
SHA1
efaf4af7a2ffb745d2fb23206d1be9eef8c3bd85
-
SHA256
02092b1f69598ecf3398e09437397c728fc452279d609d934e6dd022ec2a214c
-
SHA512
7f55b1000aecc8113747bd3b3463a346f1cae38cbf2cdd5e9770c0c3a0c5ac34edf168a195d610ac13b771e5e817df7240a0cd7a3c3a2afc751d64bc88c441a3
Static task
static1
Behavioral task
behavioral1
Sample
jKiL1mzTAVltJ30.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
jKiL1mzTAVltJ30.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cefortem.cat - Port:
587 - Username:
presidencia@cefortem.cat - Password:
Vft284Rpyn
Targets
-
-
Target
jKiL1mzTAVltJ30.exe
-
Size
1.1MB
-
MD5
75e6d9d24a6366383f3315536f9ee1a3
-
SHA1
efaf4af7a2ffb745d2fb23206d1be9eef8c3bd85
-
SHA256
02092b1f69598ecf3398e09437397c728fc452279d609d934e6dd022ec2a214c
-
SHA512
7f55b1000aecc8113747bd3b3463a346f1cae38cbf2cdd5e9770c0c3a0c5ac34edf168a195d610ac13b771e5e817df7240a0cd7a3c3a2afc751d64bc88c441a3
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-