General
-
Target
9d1f91e6929601985b6b82d29a0687568e621474d0be6711ae3d243427e1c88f
-
Size
664KB
-
Sample
240522-cnes2ahc4s
-
MD5
f6fe24c8bbba6bc5bf88df70400e6ccf
-
SHA1
15d7e7d49ddd180471317c739cd94c63c4f7fe64
-
SHA256
9d1f91e6929601985b6b82d29a0687568e621474d0be6711ae3d243427e1c88f
-
SHA512
d7dd2c6b8354b203f061ff59e4127706a3695d3b8dba87eb2666879c575401edb2b8da65703beb8d7b8ddb9973a0bd14b0ee2ac188670566df81b3218f98a2c5
-
SSDEEP
12288:mlYifT4nAnKWoKZS//pvXpVLeNS0AP3k19aLEeCV/:5iRn/oKgZess1mCV
Malware Config
Extracted
Protocol: smtp- Host:
mail.qfreight-lch.co.th - Port:
587 - Username:
[email protected] - Password:
Juraluk@171065
Extracted
agenttesla
Protocol: smtp- Host:
mail.qfreight-lch.co.th - Port:
587 - Username:
[email protected] - Password:
Juraluk@171065 - Email To:
[email protected]
Targets
-
-
Target
9d1f91e6929601985b6b82d29a0687568e621474d0be6711ae3d243427e1c88f
-
Size
664KB
-
MD5
f6fe24c8bbba6bc5bf88df70400e6ccf
-
SHA1
15d7e7d49ddd180471317c739cd94c63c4f7fe64
-
SHA256
9d1f91e6929601985b6b82d29a0687568e621474d0be6711ae3d243427e1c88f
-
SHA512
d7dd2c6b8354b203f061ff59e4127706a3695d3b8dba87eb2666879c575401edb2b8da65703beb8d7b8ddb9973a0bd14b0ee2ac188670566df81b3218f98a2c5
-
SSDEEP
12288:mlYifT4nAnKWoKZS//pvXpVLeNS0AP3k19aLEeCV/:5iRn/oKgZess1mCV
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-