General
-
Target
17f500de2cd71c52cdaae07f2a290c8a.bin
-
Size
676KB
-
Sample
240327-bp8l3abh2z
-
MD5
99a6ee8ecf593f6d3c249d20aff8d6b9
-
SHA1
ba6e9257287bd78beaf094423fb511700562762f
-
SHA256
a4cd6d72449bb1a3c01f599c367152d9b59ab37e48e84107d4e923f0fdf7bfed
-
SHA512
ab3211c0bc42667ab466781c0dce4bb0b6db7696c374fbdd2fa8186a3468a032bb3b90b8be2fa289aa983cdfae42b5641284f1452ad8e0724994c88095c04623
-
SSDEEP
12288:hsiXlD8hqTA/hIxRv6TM2GZadHacaxQX8q7xW8A6bYYw9trF5k:ucd8hqTAJmRvF2ga9acaWMqg969QW
Malware Config
Extracted
Protocol: smtp- Host:
smtp.thanhancompony.com - Port:
587 - Username:
[email protected] - Password:
aSkIhV^3
Extracted
agenttesla
Protocol: smtp- Host:
smtp.thanhancompony.com - Port:
587 - Username:
[email protected] - Password:
aSkIhV^3 - Email To:
[email protected]
Targets
-
-
Target
95e526a19a39942ee7073e28adddb685bb5bb41f889858c91bea644c657acb36.exe
-
Size
731KB
-
MD5
17f500de2cd71c52cdaae07f2a290c8a
-
SHA1
e88cfdfb4f9c30671d03fcdb2e9b85d6318bbc3f
-
SHA256
95e526a19a39942ee7073e28adddb685bb5bb41f889858c91bea644c657acb36
-
SHA512
61590ce60027a26defa2fd04d515e7242545ecd6893b7568a799ab2b6b34d16390562985be5e1f16bd7bd5dbb242d29adc291d1e68efbadb829705265c8713c6
-
SSDEEP
12288:0g4CMwp1SZUfek6vcaB5PXpPdJFyGn7xlfmE4RA36XbiiVWAmkR:LSkeklaB/1/jdlfmQQFL
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-