General
-
Target
6de0042f975538ac83786aa28a34a342379b58e2379aa9b7d4689140bb6bdf23
-
Size
418KB
-
Sample
220521-n6g7nahhbk
-
MD5
36a61475eecf60e3ba90eb5ccb7dc942
-
SHA1
43967251387cd73600292c33061c97c6fe5e054d
-
SHA256
6de0042f975538ac83786aa28a34a342379b58e2379aa9b7d4689140bb6bdf23
-
SHA512
a564c86b24b5a403b8feb638efa7d969e45010c0c6c772384800ca08d3eefc0cd5e768c1bcba0b66faf0458456116aa62f7ba4be49112cbfce39e3ba344fd8d3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.karmachalets.co.in - Port:
587 - Username:
akshya@karmachalets.co.in - Password:
Akshya@123
Extracted
Protocol: smtp- Host:
mail.karmachalets.co.in - Port:
587 - Username:
akshya@karmachalets.co.in - Password:
Akshya@123
Targets
-
-
Target
18 05_00011004_CGS4250954pdf.exe
-
Size
473KB
-
MD5
c63476a8215efa4c42ea44d37fc7f7b0
-
SHA1
9f81e3597d5f79437f288ded64bc20f4c7884a9d
-
SHA256
a0735e24f44ac731da4ae122e5ab82c4612042758c7e7cc4373eb76107125241
-
SHA512
46796a48052d73506bf5a7fa17af111f206507aba96ba89567e59aec112890f7eec1544569bffb9607b999e51e62f52d6f1c18118ceef15907380e7cc71d069b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-