General
-
Target
e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a
-
Size
574KB
-
Sample
220521-cefnzadgb8
-
MD5
525a984ef974736cb81d2aa34a9b8be7
-
SHA1
c47a81e6b69087839cfd15c90d35bdad9f17adb0
-
SHA256
e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a
-
SHA512
9635ff968bd38bfeaa0a3b366c35e876c49c40827322541024bdd05d42de5129b665f019ee327bf57c02a3b9f80cd5fc9bb3c52a2aaae2304cd16538579e3ccb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ashpraskills.com - Port:
587 - Username:
[email protected] - Password:
TC041018$4321
Extracted
Protocol: smtp- Host:
mail.ashpraskills.com - Port:
587 - Username:
[email protected] - Password:
TC041018$4321
Targets
-
-
Target
8100OJ.exe
-
Size
1.7MB
-
MD5
bfbdaa4f58a5fb04b5ebd07df65d794c
-
SHA1
626c24e885bca21d7da4f74aabb55e1e6b737a76
-
SHA256
04c7c046518196b6b88e6b3860d870e1ad21728353d8e73f23a9276a1a5e211f
-
SHA512
5793ce56e85b502d20ab43e7d30b5188063cf743b160c385fe85290522a925ad745e10691513ab7014204d93729c22e275bce76313a33c9d19fcdbad4b1f2847
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload
-
AgentTesla Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-