General
-
Target
f862245a63eff9f20a5c587d549e54ee3f6d04148c6a85df0c76911d6317df60
-
Size
384KB
-
Sample
220521-b868cagebr
-
MD5
29145bc8afe94519f14abeae1d833bf0
-
SHA1
202489c802ed2e77880fe1ba496454b869a69ce5
-
SHA256
f862245a63eff9f20a5c587d549e54ee3f6d04148c6a85df0c76911d6317df60
-
SHA512
4b3bbe4d455e81d9ef0cf26b7278e9aca9fe06a5c50b854e6a8b09f0a263980e20afd793d88a7043208f1778a346d275210c9975a571d8a7905fce0292409021
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg2plcpnl0180.prod.sin2.secureserver.net - Port:
587 - Username:
prasad@globalinsurance.lk - Password:
Prasad@gis3
Extracted
Protocol: smtp- Host:
sg2plcpnl0180.prod.sin2.secureserver.net - Port:
587 - Username:
prasad@globalinsurance.lk - Password:
Prasad@gis3
Targets
-
-
Target
SHIPMENT SCHEDULE_ADM#1246-20pdf.exe
-
Size
431KB
-
MD5
5092771bf4d63f50d9a7e5da4a6378cd
-
SHA1
600a1b78a9f02e0e5162b46926904ea416b419b7
-
SHA256
7c671aa708c21b23eb4ecd81a26321ca0a1052b4944450d0bccddc47fe2ca9aa
-
SHA512
1213353f34e9170791665f600cd91d7c0903b59c1651d533f9a4cde0355c5c62ffa5fb4a542def27dc03be0c1df4aa54d1bdd2a129f2b753feaa3258845ae388
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-