General
-
Target
Copy#1905208.exe
-
Size
248KB
-
Sample
240515-nfenvaeh4y
-
MD5
cfc42af0e543bd98292e43f0fdde7d3d
-
SHA1
b42e951c4524f3623f548d58273cbf2b25689051
-
SHA256
bd5082c530583be11d7a2099791bad33b2e25b90192866c2a7b234bfb8ae5b6a
-
SHA512
8de650b8bfc930f8601ae741d398b317f07336fc8ab03902c2a9e55e4a1c034ac89a89b1c93441b602380b3fbf828dbf1e116731efb62dd5e8124003c6a9b400
-
SSDEEP
3072:29Vc1dPKL/2XCNnCDDRvLGyrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/SPYm21S:29VcCaX+stvLGxOLbMUsK64H
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
sendalaser@fahnfinance.shop - Password:
d9GOyTceXsMT - Email To:
laser@fahnfinance.shop
Targets
-
-
Target
Copy#1905208.exe
-
Size
248KB
-
MD5
cfc42af0e543bd98292e43f0fdde7d3d
-
SHA1
b42e951c4524f3623f548d58273cbf2b25689051
-
SHA256
bd5082c530583be11d7a2099791bad33b2e25b90192866c2a7b234bfb8ae5b6a
-
SHA512
8de650b8bfc930f8601ae741d398b317f07336fc8ab03902c2a9e55e4a1c034ac89a89b1c93441b602380b3fbf828dbf1e116731efb62dd5e8124003c6a9b400
-
SSDEEP
3072:29Vc1dPKL/2XCNnCDDRvLGyrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/SPYm21S:29VcCaX+stvLGxOLbMUsK64H
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-