General
-
Target
c5bf3264918fdf2a8015b7c71e2e0337305cb6714cf19c9526eb3873f1c78e3e
-
Size
418KB
-
Sample
231208-bnsjfshg61
-
MD5
fa779f4b4d1e4861e2892f55a202755f
-
SHA1
0b491d95e46d74110a6888050f8fd54420eccd4e
-
SHA256
c5bf3264918fdf2a8015b7c71e2e0337305cb6714cf19c9526eb3873f1c78e3e
-
SHA512
90a1866cacc86f802f9ad8622032e90048f766c16785819a5f21703048e634a91f2c3b753d4202f7164296a277a1f4402b79ce67ce28247370e37c151b9f0ba7
-
SSDEEP
12288:69YIxNJ9L643BxbcSPO4uWrZdYi68bwSosJmbd28r:69JxNTL6QRhrZXPfodb48r
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
^b2ycDldex$@
Targets
-
-
Target
Hpbinymcv.exe
-
Size
367KB
-
MD5
5199e85b0c1149366cad61fb1b777e26
-
SHA1
c8796fb6fb49017c08a7e17518ec8f70a01cc941
-
SHA256
90c7b6bd3fd954125e071fca9a96c398d2c7c337e150b79c3629285858dd476c
-
SHA512
23c1c2ee74c77a693368dbaa00e21a16a86a2063b0b0c646dee703cdc502d18f99e0558a9810b71d6016484a3926e29baef749ad063a645a8e66324a5c26740b
-
SSDEEP
6144:Y9YIxlje/RK9Xgg643BxGbVs/rpFoSM4md4/mWrO3g/VwThi68dFfUdYRosJmPX7:Y9YIxNJ9L643BxbcSPO4uWrZdYi68bwl
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-