General
-
Target
9503de606f8f0e2a753d31eb10e1f92ad6b8a8c7bf51c6547760057d6077669c.iso
-
Size
1.4MB
-
Sample
240523-b64pfahb8y
-
MD5
c43168e26af0d5c2fdbf5715398da1c0
-
SHA1
b9550c212bfaf07b845c2fe2632103e68b747c1f
-
SHA256
9503de606f8f0e2a753d31eb10e1f92ad6b8a8c7bf51c6547760057d6077669c
-
SHA512
1b6f30745dcf2ada5eec6ab128b403dfd67fa9f71bf81cf8ff37b4a95e44573fca13abafc41b368fe1d22338a667a2f121c5dffb39d1fd11661994fc9bc715b9
-
SSDEEP
24576:MRVAfJWtb3BE1lMAzY0O14gZlcT6+C1MGQv:aDZBEEAE0a4OlKmM5v
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rushdi.ae - Port:
587 - Username:
[email protected] - Password:
Ah@5432969 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.rushdi.ae - Port:
587 - Username:
[email protected] - Password:
Ah@5432969
Targets
-
-
Target
Wire Transfer Payment Copy #18-05-2024.exe
-
Size
896KB
-
MD5
f350551099a8fc532cb883bdc55e31bd
-
SHA1
c757fbb281a8b883974740f6343244c54aa21c14
-
SHA256
7a76e6536ba34a728e8b04a6cb20fae3b252edc0de2e7ffa1e95508194ccecb3
-
SHA512
5dc9c5d1eb72e7060004b5415ce256a007d31c54fea1bc6d252e7680b14720e34cf53a7cabd0b49bef853f38a5e32e8f8fb5e7e38002b17a5d9bb98a94eb284e
-
SSDEEP
24576:BRVAfJWtb3BE1lMAzY0O14gZlcT6+C1MGQvn:TDZBEEAE0a4OlKmM5vn
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-