General
-
Target
RFQ PCF01284 Revised_PDF.img
-
Size
1.2MB
-
Sample
231211-jbxxeagefq
-
MD5
bc99aea51751efed128588b424219e50
-
SHA1
76548cdd7e46ef9ecd2953084f133eee493cac89
-
SHA256
0a70aedbd217674d071bee01ea538085dfac406626a1c686e7c2e3fdf8fbe06f
-
SHA512
a783e7272f54d616836a79c9f7f666789340a3fe528f867558346e06f77ec8847f569e9c1d252581c789c224256446e305249bc05e1922531c79264e777cf52b
-
SSDEEP
12288:j3IU8S6eUdzt3K43AkWh5wYAjhjrk2XHpFNlcVlV1bFKxs8mgTY/qFpcEIJKJ:TItSAdzt3KEvYNAjhjrxXJzlIwxhmSp
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.femhaz.hu - Port:
587 - Username:
[email protected] - Password:
89Femhaz00! - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.femhaz.hu - Port:
587 - Username:
[email protected] - Password:
89Femhaz00!
Targets
-
-
Target
RFQ PCF01284 Revised_PDF.exe
-
Size
614KB
-
MD5
aea1bfb57a639d6c1019ebc722662d86
-
SHA1
66674c41a064140ffd143fc88d6737e4e2a712ba
-
SHA256
083488944d0efc342bbb4bdb7881822e14781b3888ea58d1f7121dea52933373
-
SHA512
632328e08705b382797231950a3bcb9ac840d7f940d66239fc924e0c4806157d0f0333fb329d7ab9803b64f4ed561178280584a669dae19a53484e9c4ef95c6c
-
SSDEEP
12288:03IU8S6eUdzt3K43AkWh5wYAjhjrk2XHpFNlcVlV1bFKxs8mgTY/qFpcEIJKJ:SItSAdzt3KEvYNAjhjrxXJzlIwxhmSp
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-