General
-
Target
Bank FOrm FOr Wire Payment.rar
-
Size
199KB
-
Sample
230423-sb6nzsea64
-
MD5
1e7be3757283f0992264dc394d36012d
-
SHA1
f701b8c22abe4633e8e733d09302cb066f104d34
-
SHA256
31856a8460a730f9a125e1b47fac89b72d6213846848c2ee08de3c1eba04ccc7
-
SHA512
0d300cbda36f886d3e5c50c2653459d2428ad64ff32a43a524cc9247b66482e85227870c35acc70e856969de29ca6b1b291ec136d6be8cf3341ded026cdf0a40
-
SSDEEP
6144:pRFiz1aY05GUA7u4kBC0zqMNxkLwHsjbi6v:pRFiJvh7j+1qMNspO6v
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.redseatransportuae.com - Port:
587 - Username:
[email protected] - Password:
method10@10 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.redseatransportuae.com - Port:
587 - Username:
[email protected] - Password:
method10@10
Targets
-
-
Target
Bank FOrm FOr Wire Payment.exe
-
Size
236KB
-
MD5
42fc6870418ddb0645f9a6cac613e8a6
-
SHA1
66373d89647e3dc8a489dea9622b274673e1e84c
-
SHA256
0e61a0b6e3de818a74a457a051d6c26220f80edbd33370377467018f3655ce9e
-
SHA512
c902e022654809168ddb5dca79a460eb997b8e516dd8e7dd272ae80d264a72c14e4c6f31dd34f6a9bed0319bfdd1c0fac19693f8a35ee3d83d4e5e3227db897a
-
SSDEEP
3072:y5fW5CflcUTbK8OtvrH6IJTbzpHiHGwofYjEOfQVkoZFTh3U/EJP5YTPv/5bns1G:y5DJQrnJXzpOqiWkonTh3fYb35b4pn4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-