General
-
Target
e13e4d0875e3f1e3f63b6b6ec5f9f854db0a48ea436c71d9070e3831f953e94d
-
Size
665KB
-
Sample
231207-rwqmtsca77
-
MD5
f55f1785bf7e4ce7d1a49ae1d644d482
-
SHA1
3a8e1f2cefada013f1dc0a09a44c61f063e866fe
-
SHA256
e13e4d0875e3f1e3f63b6b6ec5f9f854db0a48ea436c71d9070e3831f953e94d
-
SHA512
18cf31ec6080ccaacfb3d4a049694bc23ea75c3de9d1b8039701e18166e811656c207241d17220fb77eec6f51a5559be2da1d71212232b2d692a281f04af686e
-
SSDEEP
12288:dqJifZ9kdEdxAlMGeC6qflEGVBZJZmf2AeuGKryYzJNyid+6O1suQHHbhaHw:dqKkdixJGx1fZlKOJid+6O/o7haHw
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mrgrouppk.com - Port:
587 - Username:
[email protected] - Password:
~_ShAzIa.MRG2023_~ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.mrgrouppk.com - Port:
587 - Username:
[email protected] - Password:
~_ShAzIa.MRG2023_~
Targets
-
-
Target
Remittance advice.exe
-
Size
777KB
-
MD5
1a27787328335454dd7088c23d47b857
-
SHA1
49bbde3ef989a9c4c43a4ca026cfc632fcab5136
-
SHA256
583d249d488a67e338a0bbd3c03d3967fc179e226031bebde9b0913c889c70ac
-
SHA512
faae3d7056387d240f4bcdb7a03deef3a440d96fc4dc34c6a41c61610f4d676b8afafa6862bb46ec658cb4a9f58c85e5ec566210bd165928674be690240141c5
-
SSDEEP
12288:3GHhkZ548EdxclMGYCeqflEGhBZ1ZmfMAeiOMK0sXoe1ptHWOj:3uK/pixVGTNvZjl0Gl1n
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-