General
-
Target
dae23e7dc11670ebc2b9edfc6b457e5c7d91fa90c7826bcd02470cbd9b1757fb
-
Size
582KB
-
Sample
220521-n852haaadr
-
MD5
229f48e2e85053e791b0596be098f357
-
SHA1
953a1c1b35aa89550be1cd3f358d8f891e3a7251
-
SHA256
dae23e7dc11670ebc2b9edfc6b457e5c7d91fa90c7826bcd02470cbd9b1757fb
-
SHA512
20ac9d2f9c1f94f61d56ea7ccd57614733b4b1963ee7f098c2019f1be1e2d6c7171715221cc46e7347a59a51b521b391fd575915ed9a3a2e431a9c678138a582
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
admin@slboercleaning.com - Password:
WS!jmys8
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
admin@slboercleaning.com - Password:
WS!jmys8
Targets
-
-
Target
Request for Quotation.exe
-
Size
522KB
-
MD5
90868ea38ee67574c75f0b44bc23f240
-
SHA1
6d59b6b66e6a57cbfd4bb8211c8a988d1ab68c7f
-
SHA256
8c2e223633dad17b0830a0efc0a1a3edfd835e176c5a502d36bb0021dfdbf2dc
-
SHA512
718380e06d37cfbde6e1dde2ef0c7f5e1846c34baba1234be2cf11717d7b0e55b8ea3405a49eff43fd5728ada9468d54f10f5eb9dcc8458b2038ae4931c694d9
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
CoreCCC Packer
Detects CoreCCC packer used to load .NET malware.
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-