General
-
Target
4bf8ca82dc62ef21af0218ceb1d623955bf307e3a421199eb8aa28ee8dbd721f
-
Size
602KB
-
Sample
240405-bvj6nagd2s
-
MD5
2480a729576f3ebf3313132fa80cf941
-
SHA1
050a37050ea15a8e7befb071fea1cebce3efd995
-
SHA256
4bf8ca82dc62ef21af0218ceb1d623955bf307e3a421199eb8aa28ee8dbd721f
-
SHA512
f2dd1cbb7841eaa00fd120253f24a223582a0ebd4568d3950d8b86c508a60a744aa5c20bdf002951d2350d1b39f64520d74ad7b87b4214d68e9274c26d86a10a
-
SSDEEP
12288:IoxaOEKHe/sbG7y68/FllK7n12MEXzl1+3dnQ+TCeb0nCNdE:IqmMwCXzl1R+TCjCTE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121
Targets
-
-
Target
SALES CONTRACT.exe
-
Size
642KB
-
MD5
0b7082c68c725104f4cbe2061a477b5e
-
SHA1
d1c425160cd397e964148178dca8b4a0a6ff86d3
-
SHA256
9d1f9f7012962df24baa3c3ac0816333abecf2a433953f68dab7e7673fac59aa
-
SHA512
37dd6e1c8812595b6760a58cbdad1d430c7f39b5d121e7e743d71b1ec2c31322aa19a5b810700533d3a30e432021565f6453385f685c1efb19b0e9358b8a4a9d
-
SSDEEP
12288:StQO/pn45qSYdQxUHP+HehsbG7y+8/1llK1f1+00W7RnkN3drqUHsliJ:Stl/pn45qSYdQWHP9gG9+7W5b
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-