General
-
Target
44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b
-
Size
416KB
-
Sample
240329-b87twaed5y
-
MD5
fcaf65881fa2f33b24428906c1eb109f
-
SHA1
0c929c66525d467b5e687ab5a2ce4171d2121b56
-
SHA256
44f5f7e8cc125b74e496bf172333273e0d5530f0acfcfb87986a8ea4b054c59b
-
SHA512
92f42670e0a3d9a13bd556fb5f089c7b269afb36c4dfb7036aaf264b5a65ee64722139923f13416fac64855e34f5f4cab946cd2b597bc3c37920182166ab3bc6
-
SSDEEP
6144:GlCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:GlCXLbHRjW+mcOu7ds
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.impresaubaldi.com - Port:
587 - Username:
[email protected] - Password:
9xPoy3!1r4 - Email To:
[email protected]
Targets
-
-
Target
Purchase Order_5001535449_ES010_pdf .exe
-
Size
355KB
-
MD5
c05d1f30c4e092ea20de16c871eca157
-
SHA1
5aca67a7f815192a972966ab5400a95cdc2e5ed6
-
SHA256
517ee22c4f13794348a1743e39a119c6181b9ce6dff42f7e525fcd9fc2f768d4
-
SHA512
055dcc2dfd771600625349a64b572f78777d6e6e9970893b87e9359d4b95c2e3f8ac14cbb11d1892151bc43fb40072b2024c8526c9dbc6c79547873b6d669a0c
-
SSDEEP
6144:plCXcIbbHRjWje36AmF26qrvuzuzCCdsbXt:plCXLbHRjW+mcOu7ds
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-