General
-
Target
1f8d3a5cf372d4ce155b64e4632924adf8968e3ddf5ff7a6778b1ed898a77cb8
-
Size
1006KB
-
Sample
240428-xymlvaeh35
-
MD5
bc300e395da3138f9a4fa20d98e025c5
-
SHA1
c3aac127f30bcb62e735f71ad39d799840d4048e
-
SHA256
1f8d3a5cf372d4ce155b64e4632924adf8968e3ddf5ff7a6778b1ed898a77cb8
-
SHA512
04eeedd59fb791d33a2e7d193f5dc84f915ae2d0939bd7fc6345ff4bbfae68a53bcfb0ed8a360c4e8975bc9c940ae1d6f95676f58718e6ba9a06c55edeb4881c
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXMmHabtSvahj4M5:Vh+ZkldoPK8YabtF7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cash4cars.nz - Port:
587 - Username:
[email protected] - Password:
logs2024! - Email To:
[email protected]
Targets
-
-
Target
1f8d3a5cf372d4ce155b64e4632924adf8968e3ddf5ff7a6778b1ed898a77cb8
-
Size
1006KB
-
MD5
bc300e395da3138f9a4fa20d98e025c5
-
SHA1
c3aac127f30bcb62e735f71ad39d799840d4048e
-
SHA256
1f8d3a5cf372d4ce155b64e4632924adf8968e3ddf5ff7a6778b1ed898a77cb8
-
SHA512
04eeedd59fb791d33a2e7d193f5dc84f915ae2d0939bd7fc6345ff4bbfae68a53bcfb0ed8a360c4e8975bc9c940ae1d6f95676f58718e6ba9a06c55edeb4881c
-
SSDEEP
24576:SAHnh+eWsN3skA4RV1Hom2KXMmHabtSvahj4M5:Vh+ZkldoPK8YabtF7
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-