General
-
Target
PUK ITALIA PO 120610549.iso
-
Size
712KB
-
Sample
240314-1nr1csgb9z
-
MD5
5777c8b62a8be41c8b94267b0f09a02d
-
SHA1
3e2549e10716d20fd607bc5fe8d4546a99207cc5
-
SHA256
9f4946a4ac2a703486b6ef3dceaaece51c4c5b3249e15bb4cf503e2cf16a5583
-
SHA512
d17cb2af4406bda3cf0876ca7e80b741fe329f001f8fddd5d410ff79a1dcc88a1bd3080615dafdd1297f8752076a6af5cd6e7e892753b6d8accae177ba17ca83
-
SSDEEP
12288:usJTENl3a+1+UxRhsZzc3LKEUfzPdvpkF55CSuGxCkckJ+ZWsfeXjZ:7xENllxzsZzALKxuHuG7JYWsWXjZ
Malware Config
Extracted
Protocol: smtp- Host:
mail.alltoursegypt.com - Port:
587 - Username:
[email protected] - Password:
OPldome23#12klein
Extracted
agenttesla
Protocol: smtp- Host:
mail.alltoursegypt.com - Port:
587 - Username:
[email protected] - Password:
OPldome23#12klein - Email To:
[email protected]
Targets
-
-
Target
PUK ITALIA PO 120610549.exe
-
Size
650KB
-
MD5
876bdd759d990110a2bbd617b0f2c549
-
SHA1
dec55c0273518038e0f2cdabe94d0d33e6fb1704
-
SHA256
066beb79d6fc244e4fc3db3cae1af40749798a52f6b5796f14e3612e1498bf73
-
SHA512
b3f8f1d0cc8a743e907877e699fedf08fe0482aed2d7902a93497d773978bf01d0e78a81341dcd5a6ff0019cfdf43f1cd68d7952dc9f853b2dd2eecc471a23b6
-
SSDEEP
12288:gsJTENl3a+1+UxRhsZzc3LKEUfzPdvpkF55CSuGxCkckJ+ZWsfeXjZ:BxENllxzsZzALKxuHuG7JYWsWXjZ
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-