General
-
Target
006375fbcd706d65365a463055d0c1f29c0588356be62868b95d029b6e3f4eba
-
Size
566KB
-
Sample
220521-d53rvsbhcq
-
MD5
e7c75978da0436a6a4f12613f138003c
-
SHA1
27fe80634109c79863cb3cd3b96b078bbf766b0f
-
SHA256
006375fbcd706d65365a463055d0c1f29c0588356be62868b95d029b6e3f4eba
-
SHA512
95711b8499cf70ec5a63c936b2903cd4f2dba400f5c61d42a8c48cecc9117edc524ba1b63cf289692ebf0a134b514634298ce0024fed10dae2b5ba4a1ebf9f71
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.almushrefcoop.com - Port:
587 - Username:
zainab@almushrefcoop.com - Password:
zainab123
Extracted
Protocol: smtp- Host:
mail.almushrefcoop.com - Port:
587 - Username:
zainab@almushrefcoop.com - Password:
zainab123
Targets
-
-
Target
image006.exe
-
Size
731KB
-
MD5
e88fe0ed46314160e9cc98f2e0bd4322
-
SHA1
c7280616a6bbd335f76eede4f95ba41893f11cb9
-
SHA256
5bb47f4d839af90df0d747b278c69d873127d2574a3f77965f9e7787385220d4
-
SHA512
ee58f0608222503b36033f75966075f0b501af23c8cd4d26db4bbb732ccd8dea1e4445ca54ea5563f8c3a2cb368b37c5005fd7a552a0298f04b81c3c213a7b0a
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-