General
-
Target
21052024150721052024CEQ084007738830983737820000020002RFPDF.rar
-
Size
1.1MB
-
Sample
240522-w2hxdsbh3w
-
MD5
b13d0f83a6fa3294fc95bcc0a091bda2
-
SHA1
13c9347254dc9d973c9a39a26da36ec0a9857ed6
-
SHA256
3c2970acce43b4205666a5122842b2d0e1111c7945b103d0a4dcb0fa4a087218
-
SHA512
4bced69ee9dd97102c812bb5ffffeb852d86fde4963de0013f7292e59e63f2600eca4b87559a8e551a5ba252d1c43a5273fe87fb5283d9d87efdbd7fc8dc9e56
-
SSDEEP
24576:Mjz46TXz/g/RHA3f8coq8giM5liCkNUQaX0uqFJY7dH5SL+af:MI6TXzWA3U/VMriCk+/ku+yH5W+af
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6806295140:AAG4-KC2NA0JDcYhFvVsLTmBeXMXo_2r83w/
Targets
-
-
Target
CEQ084007738830983737820000020002RF_PDF.exe
-
Size
2.5MB
-
MD5
ece6f990267fba0e365191d6558b0f9f
-
SHA1
7841ab811b01ce15915a9df2538ff469656538af
-
SHA256
105465e8fc8446745fca6287927567949b9c7a41112d4752f9cb98f503f484db
-
SHA512
b8a1ad5e44e89c3657f05bd5f32859c1479149b5a849059212139c00b4b6410544b5929e17ddc3b4aaea29aa1413ab77bb57e95b30caef1f6a02f838db116a12
-
SSDEEP
24576:hqCdMP5SdezpyFNrhSCPuoX0k6O2BusxExVJhenLg31+mYGnKBFHJETXHOahJs3:hP6hSrcCPT0JnLg31+mYGnKDKTXe3
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-