General
-
Target
507f2c214dba5c6bf2ff556b651546ca810379dab3ad30d440bc4680e1cc29b3
-
Size
665KB
-
Sample
231208-bd69vsgd67
-
MD5
a1b4c18cdc558f35d8ae2934fb4363cd
-
SHA1
df67db6abbe448d32710427e89eb467344999700
-
SHA256
507f2c214dba5c6bf2ff556b651546ca810379dab3ad30d440bc4680e1cc29b3
-
SHA512
254e31cefcf72bf7cc814465a94749d7b791a5379b1e4c1e42090706b057a4ae700d5dc85025ce8fa5b59cc01261490d5cf61fe947317e4c339ac54c5d091457
-
SSDEEP
12288:/qJifZ9kdEdxAlMGeC6qflEGVBZJZmf2AeuGKryYzJNyid+6O1suQHHbhaHl:/qKkdixJGx1fZlKOJid+6O/o7haHl
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mrgrouppk.com - Port:
587 - Username:
[email protected] - Password:
~_ShAzIa.MRG2023_~ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.mrgrouppk.com - Port:
587 - Username:
[email protected] - Password:
~_ShAzIa.MRG2023_~
Targets
-
-
Target
Payment details.exe
-
Size
777KB
-
MD5
1a27787328335454dd7088c23d47b857
-
SHA1
49bbde3ef989a9c4c43a4ca026cfc632fcab5136
-
SHA256
583d249d488a67e338a0bbd3c03d3967fc179e226031bebde9b0913c889c70ac
-
SHA512
faae3d7056387d240f4bcdb7a03deef3a440d96fc4dc34c6a41c61610f4d676b8afafa6862bb46ec658cb4a9f58c85e5ec566210bd165928674be690240141c5
-
SSDEEP
12288:3GHhkZ548EdxclMGYCeqflEGhBZ1ZmfMAeiOMK0sXoe1ptHWOj:3uK/pixVGTNvZjl0Gl1n
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-