General
-
Target
NEAS.95724f9db7afd6a924c572c80cceb115c20e504ddf61d8e226418f206df30af0.zip
-
Size
621KB
-
Sample
231202-l836ssbg35
-
MD5
67720df23a4333322e6301fb51d8bdde
-
SHA1
cb3aafafec90f7f0e507c1e13772647245beca92
-
SHA256
95724f9db7afd6a924c572c80cceb115c20e504ddf61d8e226418f206df30af0
-
SHA512
02fce8da36a9f07b78079a7d64943e6490edd820fae77ab8f11210cfd16c9de95b77bf431c3d3b348eb0608ae7c674023a4bd0daf5324d8e8ddb42a4678ef605
-
SSDEEP
12288:/jq13qPieC22NgqzkYxkBnHBFRR8NRcFd9NHgYInlDiWrv8mwWW:/jq13qpsxonxaN+F/pcrv8Bv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.lubdub.com - Port:
587 - Username:
[email protected] - Password:
J-y!2e_fWMH_XP8F_008 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.lubdub.com - Port:
587 - Username:
[email protected] - Password:
J-y!2e_fWMH_XP8F_008
Targets
-
-
Target
RFQ235658.exe
-
Size
673KB
-
MD5
92330463b66638fc2f745cba74d1638f
-
SHA1
d94d75a811885152bf7764529afbe79e6dfcd078
-
SHA256
cb56a616b456b089946738d62f352b134934ce2e9e23ce00cfc803e35748cfce
-
SHA512
e8363d81d23beadb9d4c33db7a046596a41be83b57d4f00c96dcd02c4245271f24e78aa2ec0a3a6ddfd4a1dcc74c1b2873655ebfc7ec10e3c9bb44e4fb66885a
-
SSDEEP
12288:ACwAJyImgqzkUB/hBnpxRRR7g6xrZUbygh9sUOd:yAJqBLnjCmgJhrOd
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-