General
-
Target
10b29911c8531578cb5d7001179e8c4ef7c3d608d50fca7625ea82cf5b49dec1
-
Size
401KB
-
Sample
220521-d1tndsgfd6
-
MD5
4b4066a8c40c670bbc6cb5168959c7e5
-
SHA1
a7a9a4f47449c30e39c262063629dc9d9f07766f
-
SHA256
10b29911c8531578cb5d7001179e8c4ef7c3d608d50fca7625ea82cf5b49dec1
-
SHA512
18e5ba6d96a23bd9b8f310324dcd501d31e2e7ae50ae0d20c109e5dad4ecbfb89055f0a0af500e2080f6ebacd2eeda4de07b116cf5b2fe7f033314e251f29c53
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.elhelado.com.mx - Port:
587 - Username:
servicio@elhelado.com.mx - Password:
4042Ad@+
Extracted
Protocol: smtp- Host:
mail.elhelado.com.mx - Port:
587 - Username:
servicio@elhelado.com.mx - Password:
4042Ad@+
Targets
-
-
Target
11065-AMM0000557423-736065949.exe
-
Size
455KB
-
MD5
39b71dd0dc801e89e04f0d2b3824b55f
-
SHA1
5d3f749ab772af6552cc81d807c723e8181f5fe8
-
SHA256
e390ee24fef5920157d9c28af8d232cd542f30b193481fef6fffb007631f374b
-
SHA512
2a9fa2de4f5f58fe6516ae2098cba672a2ec0e790334f2c310163789e2624df865fc05e7abc140acc914b3165d5ee89aaccd5350025da3d3912bd500b5f1a730
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-