General
-
Target
DAI SHAN HAI - VESSEL DETAILS.pdf.lzh
-
Size
644KB
-
Sample
240522-k65feaad81
-
MD5
ac4d3d8b8d2eba804b9cf41b772f7d53
-
SHA1
eefcb34a12de51a8f24551df1aea4e431d5cd787
-
SHA256
435aceac3e6160120b209c2684a094961cf1dd4a474e83f2de230da0e58c831d
-
SHA512
bfeb1c6b642e876a2b382f45740128f815958bd4ce277fb25cd122275990a5da405dd06a4c898705d33217f5645bd6bd29cad59999cdfc46342379a3dae4fea2
-
SSDEEP
12288:79UpWiB9V7GnmxMMiaepOZ80vb8i78r48xHLKrlJU0DRWeyT+MgH:7itfKmxMMGpK3jN58t2rM0DGG
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
DAI SHAN HAI - VESSEL DETAILS.pdf.scr
-
Size
665KB
-
MD5
b51160bbcf48437d66790f228769ce73
-
SHA1
38865f0047aef6afdeff054baf3e6387ddd2b012
-
SHA256
89bd0410a26507a9acbb4d5150b5f284e7a4263ddf65930234d9a3ebddb26da3
-
SHA512
ed8714a3e4f918bf0cb62edfc19300714366e55393b3abbf60f8fd5b439146ceee26b062720238484efc0c240a2ceeadf981abe2f7406bf6b567f871f2acc1bd
-
SSDEEP
12288:Q99RHgaa+nw+eybQ70OD0PdLGv4ZRo0WSJR+/2x8MARET204MK2eyBeg:QxAaa25eybVllLPZW52+MARJ04t
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-