General
-
Target
450a4ab336664ce75f68c7834800fcb8.bin
-
Size
85KB
-
Sample
231106-bz74aafd9y
-
MD5
d9458bad2c1c6dbce6afb6036bc90028
-
SHA1
e118b3514624985f612e65eaae2625c2d88f9613
-
SHA256
25904f22df6c31c8c6ad16836d00f05dc9ee66807b0d823bd62ace0485ab9e0b
-
SHA512
fee2e281d3a1784452b8f97c76846764f846bafc2d168082a176735d6e3777f59f04110f3fd207344df0fc86efa658e0d2a1fb9a42aec2205ce18c09e9ef6ceb
-
SSDEEP
1536:FWKhXS0QYSDH8ZyuKsuYEWjEwYf+ycZy8pINTe0wgh2BmY7qQc+IJ:PhXyV8ImJEuYzcZnsBTEB+L
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.atelierzolotas.gr - Port:
21 - Username:
[email protected] - Password:
alibaba.com
Extracted
Protocol: ftp- Host:
ftp.atelierzolotas.gr - Port:
21 - Username:
[email protected] - Password:
alibaba.com
Targets
-
-
Target
16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe
-
Size
240KB
-
MD5
450a4ab336664ce75f68c7834800fcb8
-
SHA1
981571f6e46d00bfadf9e88a1e780766c321a8ac
-
SHA256
16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09
-
SHA512
17edf46c32c8df85380fbfec7b4c5b399875b28b10b960418dcac4147b66df8457dacb3e66d046f170a5bec85c8a39ada9b6d09c133868c3b8291c1dd87165fa
-
SSDEEP
3072:CdA67f9xtpdnNVtf9IXSHwRRODpzfEmYFDwu5LCK+9GR:Ca67f9xtpdnNVtf9ICHwRROoFDwNKCG
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-