General
-
Target
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
Size
1.2MB
-
Sample
210728-pmds3ppcqe
-
MD5
e330461dfd3ff5099a0b05e06bc4bda9
-
SHA1
0faeb359703506fd0e0fa21ab3b23dda5ea868e6
-
SHA256
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
SHA512
078bd784300123e45954db43d8d2ad941af2015856e533781303a60357f56d013cf9a3da1c023b38df81e0e186103bf98ed7f8edede42b35a6128e0b4a9381dc
Static task
static1
Behavioral task
behavioral1
Sample
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e.exe
Resource
win10v20210410
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.themainreport.co.nz - Port:
587 - Username:
[email protected] - Password:
-I;MGhTyL{AQ
Extracted
oski
fine.le-pearl.com
Targets
-
-
Target
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
Size
1.2MB
-
MD5
e330461dfd3ff5099a0b05e06bc4bda9
-
SHA1
0faeb359703506fd0e0fa21ab3b23dda5ea868e6
-
SHA256
f85de586c3a33df88ebb5493c0bbcbd18c9f732e201c4c1604f2b2779976434e
-
SHA512
078bd784300123e45954db43d8d2ad941af2015856e533781303a60357f56d013cf9a3da1c023b38df81e0e186103bf98ed7f8edede42b35a6128e0b4a9381dc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
AgentTesla Payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-