General
-
Target
e4887d25cdf92b26469cb83529af47e4248f93bf0465ed3759f331d3bdf71c0c
-
Size
403KB
-
Sample
220521-bmv8yscbc5
-
MD5
7a4969bee94674935cb9c1787ea46be7
-
SHA1
ac2c9da8a1c1c0c54f8d72cdddac0e54f7712ea9
-
SHA256
e4887d25cdf92b26469cb83529af47e4248f93bf0465ed3759f331d3bdf71c0c
-
SHA512
742e34979d2e8c358640b47bff1c7ae13dd47f7f477d0092030fc13856109529143dff3f2f490b8b2dafc27bfed9b9978f4ecc53996f31449432f61178637106
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.ahrass.com - Port:
587 - Username:
[email protected] - Password:
chukwuma22
Targets
-
-
Target
Payment Advice.pdf.exe
-
Size
455KB
-
MD5
6ad6ceabd5276ef0ac02cacaeb8ec2b0
-
SHA1
fb3b7b648078309f40db8fe6bb463f9315cf66d5
-
SHA256
5ce2d2774ba40e6dc9997abefd9d8d50321eb37b26e3b6963add26877f036a3e
-
SHA512
496713183cbcaace5d526ce0bcbbfedd294caa60336ce8191bda10cf086c3ef80bb23246a307709b94f5d793c4376c1b2568b376d94fafccec037a8ebf393aee
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-