General
-
Target
HWQ_0193832.zip
-
Size
368KB
-
Sample
210128-da9g3zhsxs
-
MD5
c8400e3b40fee0f0e8bec2e18ff087eb
-
SHA1
b4769ada9168565b5574be4471c17c6c3530af33
-
SHA256
33c758375f4c1da5b9d98e00f2e7806b9cb50ae07a1b063ecdb15231c3a80198
-
SHA512
200355e83b354d069a631280e4c65df3b536449627bab6b9ca83479cd5dcc3f6d550c32a12a936f1bcc329e69e2f3100b0a7f60d72809c3089d3ce49b6e9320c
Static task
static1
Behavioral task
behavioral1
Sample
HWQ_0193832.exe
Resource
win10v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
LifeDram2021
Targets
-
-
Target
HWQ_0193832.exe
-
Size
1.9MB
-
MD5
bd24396429f4dacef8dbb62ec46d7555
-
SHA1
b42ef1c782bf2442ab6c73541948e13630ca4566
-
SHA256
0f013d8c1f9825cb0d059dacfdfc708281e5f44369d73d6ac9c1b1098eb2d616
-
SHA512
434ad42f64f771185b0d4eb6641c935e4d16dbd8c9fc915504577006c276f10e8d6138cf69205ef657c120040c6079ad0aaa91d01ac03598daec0ce02a44f80f
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-