General
-
Target
HBC-13796-RFQ-ARCH-001-01.zip
-
Size
1.4MB
-
Sample
210125-5z5ykrf37n
-
MD5
7eac8d187a63aa6924800972039a4d28
-
SHA1
f505b0d50f7bceb621c827175d47c4fea7a57640
-
SHA256
ddef089f2d872ad7b69f2bbfe809fadace6459db31264a7b9de25510a8cb386f
-
SHA512
8ac58a330d13a709f6a8ff218bd8cd1a8f06cac883291a1c9cdb2ab1a63ca7f144eee292274748609a64006e5cb9b161b47894dc926f472d16849514bb1c8d0f
Static task
static1
Behavioral task
behavioral1
Sample
Materials- EW-20655-18-J-D.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.126cn.us - Port:
587 - Username:
[email protected] - Password:
QQomDnd5
Targets
-
-
Target
Materials- EW-20655-18-J-D.exe
-
Size
1.2MB
-
MD5
e1079033bc61f1374a072d75483e41b9
-
SHA1
da7e7a90390e46190f1e3baa6a4c9c595fc6d76f
-
SHA256
3cc185ca1e35fe8277c660731763f0a62f516ca21c01feb4009de89ebf6643de
-
SHA512
d565da17caa2e278986c152b9e38a0042f343609004faea64894e5adc0c0dcf212440dbaffef110db46617a7100d47ad502b0f2d2fdf5dc7d3a526880e2df982
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-