General
-
Target
ecb2f509c4902d8ca837931180fad5bae96e11aacfabfd389cef89f72956e54f
-
Size
430KB
-
Sample
220520-3lsvzshbc2
-
MD5
1a669483481e2c113cf01339547551f2
-
SHA1
960b9302a3059edd3a23b2957d435467004d3a49
-
SHA256
ecb2f509c4902d8ca837931180fad5bae96e11aacfabfd389cef89f72956e54f
-
SHA512
135eb7e504f6bac484d2cdd9fef5124ab66b3a5702eec73a786f646beb8c83002a002c14cf3d3e94f45baa6153789e2103fe5a0ec7ce44984441bbfeaea4670a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
fingersawumen101
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
fingersawumen101
Targets
-
-
Target
AGENCY APPOINTMENT - MT Petrolimex 15 due - est PD_pdf.exe
-
Size
759KB
-
MD5
5785ea17f322e4fc76c66b244b04225d
-
SHA1
b6572e09ed29587efb9b2fd6dc3fd544337b4718
-
SHA256
6ec3ac81ecedb31e97391ccfea358b309f88fd236adafa46f4624c7f5b05a81d
-
SHA512
ed9aafde869d79adb0b2b9bd15cfa3c6280417da415ad4ef767763101132a9d2c985ae1769336d460bf60497a9321faba01b5f33956a354e323ee7081d33c2cc
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-