General
-
Target
ORDER FUZETEC PO2311-000031.rar
-
Size
311KB
-
Sample
231204-qmskdsbd2w
-
MD5
1818e9167ca1b95dd1e6d3e02be1c8ed
-
SHA1
333636601f605aca289210786090f2e374fa4451
-
SHA256
04b079866d5cf8adf944e484210925524a14517a6d2e3c3b5c6f18317f8ea232
-
SHA512
d803e32efa0e8ad4bbb313cba69796e9dc3824e82812c2495c29be122b3b36f81924610f87e9b3f58d28157f17539681b63790b2262473f2fa588e24262ed50f
-
SSDEEP
6144:qarOCCNqI1qf2Jd7nEhMerIa/2t0Sled7wEBQabvrgROxnPiqVO6z:7r3KZk67EGeD2t0td7bQagU4aO6z
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@
Targets
-
-
Target
ORDER FUZETEC PO2311-000031.exe
-
Size
383KB
-
MD5
9abefcb71f2f6808adc286ac83f5ef2e
-
SHA1
8f83d05ef4d201ee7b6dbc50eff66018a816ff73
-
SHA256
6d7ca76f65a253a1587d1f5a94d7ff27d0babf11b830fd778efb96ebd8196442
-
SHA512
b2088e247b3f259579e080fd43d0e15c61c5b8ccaa1699aee485b800a663abf81294fd128c6e6c32769689da161981b02e55e71378aa6a1c279c45a760242b59
-
SSDEEP
6144:EwTD974CbCFRov/04ak4+HG8GBZzUMTkI5yi8WY4Nf31h/m9vMBjg7DR5d:EM2G0av/GBZAM4Ad8WY4fhcBR
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-