General
-
Target
fad4966bbd6c5f0f1c4d145a13d50af1cd1fbf50e58416a172e80cc7bf2f9a89.r00
-
Size
632KB
-
Sample
240523-r5v9nseg7x
-
MD5
4a9635b2272153064276f26e46bae3b9
-
SHA1
b2165a12a5137c73d57afbb3f840406533ceb19d
-
SHA256
fad4966bbd6c5f0f1c4d145a13d50af1cd1fbf50e58416a172e80cc7bf2f9a89
-
SHA512
6491ce7513493dd17e1f4f8701bc2d9ca312fd9d5fb98ec702e1ae7267fb0f2b1b088c896d2780d4e4f320df7027bf936966dedaef106191ea3df29689ed0118
-
SSDEEP
12288:0S37ecGQLGNsv8UksfJEEoP71Ux80t9SgDR++Zupofsx27fP287b:ieLGUkmToTGx8mA6Rrupk7m8f
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.wapination.net - Port:
21 - Username:
[email protected] - Password:
sync@#1235
Extracted
Protocol: ftp- Host:
ftp.wapination.net - Port:
21 - Username:
[email protected] - Password:
sync@#1235
Targets
-
-
Target
Shipping Reference_AWB 6032805671_INVOICE_PDF.scr
-
Size
656KB
-
MD5
f61b7d7337d4d86202084480e0a96e27
-
SHA1
e6c8a6f2a7b49252983a227a570397f8e866edac
-
SHA256
29c85d7e3ddc8db0c7f0d11b705210e12b861b254e621efb07a06b57755cd373
-
SHA512
6790f644b8213fe87e2a03c5a64eb99ba90bf882aca1407a9becd8ad81e661bc747f87d9f3a75db64888bb755f8d3d59b9d1af3db0f6968ad650de0bf0ffd675
-
SSDEEP
12288:WxlYifTgWwOvcyncG9/wFTB6LVI/aA5NeZILY3ovRM0S8X+N+00Jy3AtAsEC2mEa:W8iWPyIFTByyaAeZIzvq0Z+NP3AA5kO
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-