General
-
Target
3cabe86fa83fb6c4c2b4e5e8ad53b94a8ff2e4e4069476d05466b5c4ad0b0429
-
Size
1.3MB
-
Sample
240425-cvcx1sde79
-
MD5
693cbabc5fe39b0bac47866cf745dbd8
-
SHA1
20ab2cfdda68920a043939ee8def915a718fe499
-
SHA256
3cabe86fa83fb6c4c2b4e5e8ad53b94a8ff2e4e4069476d05466b5c4ad0b0429
-
SHA512
c9044d96f0de7ed3e3f44eec9da796dfd1736c521668ced8a8de053244576c24c986bdb9f50b34ec0844be835757aa8b50704622901ad89ceb4b62f60cba18ba
-
SSDEEP
12288:lF2iNiQagXzGNvC1ODu2x+YINqlo+u7QL3GdekWNVn/dWgqc+clv312Z337:lF1LavkY62YYIkX3GddW/nq0J312ZL
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.klptruck.hu - Port:
21 - Username:
[email protected] - Password:
kCu}[Z7z+)S[
Extracted
Protocol: ftp- Host:
ftp.klptruck.hu - Port:
21 - Username:
[email protected] - Password:
kCu}[Z7z+)S[
Targets
-
-
Target
PI89454 007PT865.exe
-
Size
774KB
-
MD5
3566c7155545174bef0308836ad16ada
-
SHA1
84950e601ef0e95ba6c98edee61d50a4354b2a7f
-
SHA256
9eb769fcd5d9616391c7ba5c4e029faed264b65e97e45589d0176ea544e2afc8
-
SHA512
7af6b984f95398c28d81a43483f6f44dee77e168cf06ed437d06a59ed482a6e6043101e51ce37d916f35911fbb1ba929b07b68b520d35a474a3311e5e725d862
-
SSDEEP
12288:GF2iNiQagXzGNvC1ODu2x+YINqlo+u7QL3GdekWNVn/dWgqc+clv312Z337:GF1LavkY62YYIkX3GddW/nq0J312ZL
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-