General
-
Target
c07c79ad4aff3daed712876961bced12280293a4481b7227c07142873e80772f
-
Size
1.3MB
-
Sample
231205-vtwb3sde77
-
MD5
230132aa5ece90c71394aaed37eff2b7
-
SHA1
c4fd1fdc6df0cfad8362631f9eae372488b8cb73
-
SHA256
c07c79ad4aff3daed712876961bced12280293a4481b7227c07142873e80772f
-
SHA512
821b12084d9d1ab191af65d5ed8d66ff9cc1d9be7ec5adb04e0391618cacacd42885c067384e3f16b3259a4b0273450628961be21d9cc8e6abfff2253769373b
-
SSDEEP
24576:534/up+pJxZJVKSo8l0WIFBdHGR9W/uq:538PJxZD/l0FY6u
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.webdnes.cz - Port:
587 - Username:
[email protected] - Password:
knihakniha - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.webdnes.cz - Port:
587 - Username:
[email protected] - Password:
knihakniha
Targets
-
-
Target
SWFT_794.EXE
-
Size
812KB
-
MD5
a21e01d4c2ce154de0e9a89b63c8ec63
-
SHA1
21f9ca2d21c8a1d021273f6149e4638cf4cc700b
-
SHA256
17fde7224cda251d6be65b425428b449341d631737a269f77a8bceb4164b4512
-
SHA512
55b06ba03ac549c3bd6690a33c33a003c671acbad5e0798d4065cd68d1b6dac10e5040722f564664ad3a92e22c021fd4072be21a6d21a8eb65616831d3c4eab4
-
SSDEEP
24576:R34/up+pJxZJVKSo8l0WIFBdHGR9W/uq:R38PJxZD/l0FY6u
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-