General
-
Target
84ff488c3f5e807a4f0bd00141a0ffbf40a617fc84b17f4545b2ead66e3d4d1b
-
Size
404KB
-
Sample
220701-sgesfsbab9
-
MD5
28981f94d6aa96ae922b7c6a2637dbc9
-
SHA1
7472efbb0dc4e89e5266d3759708203c4de07b82
-
SHA256
84ff488c3f5e807a4f0bd00141a0ffbf40a617fc84b17f4545b2ead66e3d4d1b
-
SHA512
c87671d727f1832972e8b712b863e03beb5134cd24b5ebe49e6bd8d55852131a68261e63978f54d2c56750d1bafe4a702fa00dd0ca58383c3cd9164c72b35032
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
eurotoolz@returntolz.com - Password:
Protected@123
Extracted
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
eurotoolz@returntolz.com - Password:
Protected@123
Targets
-
-
Target
PAYMENT 1567_0001.pif
-
Size
487KB
-
MD5
32916faaddae9b5d16ca910ad044646c
-
SHA1
cde19ecbedba9e97abe62f588b0dd9b78dbc50d3
-
SHA256
8eeca9884be4d017c4c5cf62fd5b080efd5cf3e9c85d70c518ae31d796713110
-
SHA512
3af7646f041ceb28f7c126332224b8899a4b16a7544bb569d14936995920eb6ef7c26e7500fef4ab030a15236a65400e59ff72c16d27bad87d2d537d9048f35b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
AgentTesla Payload
-
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-