General
-
Target
5619683e46e49a0feb993274b8a7df995a13deea29aa6ed90bebcd0c8e2c1662
-
Size
1.8MB
-
Sample
240513-peyk1aeh75
-
MD5
d3ca297a30c5714950c219068743c5c6
-
SHA1
5bd2864d431d6832ff3a957143dbbc178c0e6d42
-
SHA256
5619683e46e49a0feb993274b8a7df995a13deea29aa6ed90bebcd0c8e2c1662
-
SHA512
606be7d2f01dc8fa07e9775853aa507bca8000923661dff0c682ed28babb46ac2703d71f43d498412dab380c57639c171d5614c271d19c356ded311dbf941d07
-
SSDEEP
49152:p4lP9FyQ1oe4GTnNRZiept2tBkuQ5EC2tcGC:Wl1xWe4MNThGh1+h
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sturmsgroup.com - Port:
587 - Username:
[email protected] - Password:
$(bQkIn8%O#z)bWw - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.sturmsgroup.com - Port:
587 - Username:
[email protected] - Password:
$(bQkIn8%O#z)bWw
Targets
-
-
Target
Frndsbo.exe
-
Size
4.3MB
-
MD5
6880cc8bf81c3473007941e8fb6a78b9
-
SHA1
9b964817a55cfb04e7d0eeb5b8f654c6f0bce721
-
SHA256
097690ad443551d8f9452a7377898e00941d46905aa7434fc0639f76baa77e84
-
SHA512
abaa8df0d6ddb221fbe9960bb248de599a839f431befdc88d913e78a0b2c31336ba73b7ab72fb6bf5fd58a1f38c0ce6f0d6b1f24af7bb4eb8d835dd128318bc8
-
SSDEEP
24576:V2nU3nenLyl6VzMex4hI5uv2Zf0+n5HugDTzpwnWbq0y+3HJEzGTMOmIvYa:
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-