General
-
Target
TEKLİF TALEP VE FİYAT TEKLİFİsxlx.zip
-
Size
1.3MB
-
Sample
240522-j4fhtshb96
-
MD5
44cc138e2a41708a4cbfad61193873cf
-
SHA1
93d96e5110224850a0f51152bb4e29c9eee06fc6
-
SHA256
974ffbcc0cdba0f379766b343276d721e4093135923c8fa0068d129c0685a69b
-
SHA512
78c32cc3c2fdf185890339bb23a40b3ab72a4528cc081e1e6564c238e7b1f7362286a4380635ef6fe3d755c9912db901ed3cae3502a51425efeac3f10e591a93
-
SSDEEP
24576:ZIe9Usds9wAK/vQeiXZx6iKKEq/WWsnW/KtZ31V9PBSutLFcY/C4S7ZvC:ZIpsowAK/vXU6BkZ0WYZ31jPdtZsZZvC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Targets
-
-
Target
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe
-
Size
2.5MB
-
MD5
943b8ec27c9e3997239b317f081ec3e4
-
SHA1
c5d9639dfbda1c3fec0f7e7ff9c27790074c0009
-
SHA256
09ec4ca4e05a633b0a8114607cc08fd062348051d17f745d483cc3646279722b
-
SHA512
7eaf696ca9448de6363903749ef5d3fdb396190b656e8e87f4874a2a00ad19cd5725b072e1514dd90c4ff73eea590629b4e82b5fc084233aba4c44fbde7db490
-
SSDEEP
49152:ZP6hSrcCPT0J5Lg31+mYGnKDkTXzTnSPb:iujmmYGnKDkTzTno
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-