General
-
Target
Fizetési tanácsadás.tgz
-
Size
787KB
-
Sample
210128-mxndqmtvra
-
MD5
2c480e1addcd4ce1393440a2400f8bd9
-
SHA1
f2f8a44576512f41dae3d50a6873160bb3b05c38
-
SHA256
2ae9401794a374fe3beb00d3cc8c2a5027aff614da6a6f8dcc55168db7db3e62
-
SHA512
a2e61469752432cedd24c9ad9572eec0023f7ad6fe2eaccf639804f7ac7c9ced72aabd77cb621d413337a42bd7bf6ac8b4a089de7da7e291a2eeb4c8a8b32c89
Static task
static1
Behavioral task
behavioral1
Sample
Fizetési tanácsadás.exe
Resource
win7v20201028
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.1and1.es - Port:
587 - Username:
[email protected] - Password:
qWa8u9_2
Targets
-
-
Target
Fizetési tanácsadás.exe
-
Size
967KB
-
MD5
0f0c2a52bbc9d97a355004d5c9b04000
-
SHA1
fb26589bf72aaee554c94c4d28dc52df86e1394a
-
SHA256
7ea78278b143f8f4b67ec461309161e18c571c6783ec993bf2afdf8916f346e2
-
SHA512
c3a9bd4b55da23cf0488d9618f09c308c0f49f9cf725d220adcccf600fdcf589dbbc6c9e79d97b14239181a44133322c8cf5d9294cfecd0da5b9317c9db3a0dc
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-