General
-
Target
New Email Added and Messages Alert.js
-
Size
508KB
-
Sample
220621-lg2hwsehh9
-
MD5
0a74331331f9118783c14a258df23047
-
SHA1
bfc2ad650dcf6271a07f6eb5ce3efe82b87b7c38
-
SHA256
b4629fb4d969ce71bc3e0f8725243ed55f592a944a9ab43044e857d896dee871
-
SHA512
516f8d65e05b581b9262945ef9b8d69bd09319c3768d65ac5b7dda3c065722eba63c5baaa48a9214b724764cf03447235c301025a8b815eb3d80d080be55adc6
Malware Config
Extracted
Protocol: ftp- Host:
files.000webhost.com - Port:
21 - Username:
zincox - Password:
computer@1010
Extracted
agenttesla
Protocol: ftp- Host:
ftp://files.000webhost.com/ - Port:
21 - Username:
zincox - Password:
computer@1010
Targets
-
-
Target
New Email Added and Messages Alert.js
-
Size
508KB
-
MD5
0a74331331f9118783c14a258df23047
-
SHA1
bfc2ad650dcf6271a07f6eb5ce3efe82b87b7c38
-
SHA256
b4629fb4d969ce71bc3e0f8725243ed55f592a944a9ab43044e857d896dee871
-
SHA512
516f8d65e05b581b9262945ef9b8d69bd09319c3768d65ac5b7dda3c065722eba63c5baaa48a9214b724764cf03447235c301025a8b815eb3d80d080be55adc6
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
-
suricata: ET MALWARE AgentTesla Exfil via FTP
suricata: ET MALWARE AgentTesla Exfil via FTP
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-