General
-
Target
174255ee4e6d74fb86b6f16eae3d0298cef64bc991fa8e6c8e9d13b958b657de.rar
-
Size
687KB
-
Sample
240523-bjasvafh71
-
MD5
a29a3627858399ef50e86d41bb8b31d8
-
SHA1
2571206ee8d59606df9ebdfc426f9a3bdd1696b7
-
SHA256
174255ee4e6d74fb86b6f16eae3d0298cef64bc991fa8e6c8e9d13b958b657de
-
SHA512
546b08738513aaf7d18862cd9e2703c3df52e2b1427fe9998c697d56baa5958cb8150817900f1f32ab900d734608f87c20b4d2a826b1748450200d85166d1a2b
-
SSDEEP
12288:mLhh7hNqvyvC/xIylghrOhFTEpT3pPBtKDeQopaMWpfB4NHR/sEK6Yg1h:Uh7DqK6SUgh0NSTaB6/TN6EKtO
Malware Config
Extracted
Protocol: smtp- Host:
mail.bethesdakindergarten.com - Port:
587 - Username:
[email protected] - Password:
kindy6014587474
Extracted
agenttesla
Protocol: smtp- Host:
mail.bethesdakindergarten.com - Port:
587 - Username:
[email protected] - Password:
kindy6014587474 - Email To:
[email protected]
Targets
-
-
Target
Quotation specifications draft20001.exe
-
Size
844KB
-
MD5
e4aaca7e0fe69ced3fc467506885a9d9
-
SHA1
dd9554514cba10808aa3e0f32c9f5f22c37e6995
-
SHA256
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc
-
SHA512
8254f7c3844db4e95f98431a00c7795650b5c9720670aac178b87c2ac444c86e34bc84f53ffd59fda16781aab6fcc86fcf81850f007189ca65db2c61dfbdbbc5
-
SSDEEP
24576:Vw4bjw4bajqV8d707FhxVROXXaeSA+oafS7:Vw4bjw4bajN0xPOCBfk
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-