General
-
Target
27032024_0407_26032024_Aviso de Pago_ Banco BCP_pdf.7z
-
Size
143KB
-
Sample
240327-epqm2acd52
-
MD5
d830aac24cf0673ad962023298143e1f
-
SHA1
7a3ad913e8a11ed55620c0f2e4a6cecd3cd91c26
-
SHA256
799d82d6973a29bdda75b904d43bed7d3b374e32fcce7d5d78c97c3a92e380b9
-
SHA512
d6d0939decd9fcb60792c3620125b30cf0efeefa18b39c7a6e87c863c25ee1c19f7d6fd6d97df669c839d1c1ceb1d7e3262d7e139ae30d4b0d1a21188c8157ef
-
SSDEEP
3072:Nsg5Qt4q7NQx0QEEk0NsX6igS7s/5MNchaeKC38mrNSKbktvtpo:z5fa+0QVNsKpS7AMcM70SmOty
Malware Config
Extracted
Protocol: smtp- Host:
mail.agagroup.lv - Port:
587 - Username:
[email protected] - Password:
@Aga#Group777!
Extracted
agenttesla
Protocol: smtp- Host:
mail.agagroup.lv - Port:
587 - Username:
[email protected] - Password:
@Aga#Group777! - Email To:
[email protected]
Targets
-
-
Target
Aviso de Pago_ Banco BCP_pdf.bat
-
Size
191KB
-
MD5
61c6c921b92689fc462ef98cf4393c42
-
SHA1
c7884d1f87525c5eef499fafd07b4480be7e41ce
-
SHA256
cd840d3989614de52ba00dd9018f5be25d466da3ff1c9e4069e4590791c5818f
-
SHA512
03ca18981b20f4373102f50c4ed17324c0c7010e61bd906dfab9a5cee8df07d93b390e58348a56d220d41ccdcedfa6c9b3bb9925c452580f2da0c2ecf5214f0d
-
SSDEEP
3072:eIHnuWaKzqMxl9XVZM0yKfTX3lDnZwGx+x+8gNkssp+kmsKpUCasZyHQiaTmcxas:nHuWaKz7H9XVyonJnZitwks2rsUo0H5o
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-