General
-
Target
da713f02e7044a3b63ea9a30006db81ba4577d87b0611aa95205be1df742aea1
-
Size
1.2MB
-
Sample
220521-cf8q5sghbp
-
MD5
9207699851aef20c5bd98ff9bc8c44b6
-
SHA1
6b79644051ba3065d7b9ee5a9b6921ada90c24df
-
SHA256
da713f02e7044a3b63ea9a30006db81ba4577d87b0611aa95205be1df742aea1
-
SHA512
63b345c11aca33b32398f73d12b61ff28a0a757449faacb388f1a614cb942fe682b9c6fa585936967efeee967a122fbfc173acc571a0b76597bdf280d7cd1cc3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ilclaw.com.ph - Port:
587 - Username:
emingles@ilclaw.com.ph - Password:
P@ssw0rd
Targets
-
-
Target
NEW_PO_J.EXE
-
Size
707KB
-
MD5
56691af2924510627ff5ebfebbf34ae6
-
SHA1
2da88ce034e652d40d621a1cc3fe5abc6a5c46d5
-
SHA256
bd0942599a238c4cdc3c2da9351ce62e14e6a212513ddd66b9da598fb35dcbf2
-
SHA512
e52797941bb070cbb091387e236218911a7738a623bf4cd4be97e2c9de12985acc115626dde57711ec5b0610b8d88bb6be9ad75d430f06972a16f89c25afd0f9
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-