General
-
Target
ordinul de cotatie.rar
-
Size
648KB
-
Sample
240523-s777pagc68
-
MD5
7fa22f47f43f5f5f966a7487d87457f9
-
SHA1
2deefbbebd686979db281babf8dc4b4eed0226c9
-
SHA256
5be0ccfa2a798666d60144319d4d2ab437b31f87dbf62a3b656ec12ba6777bf5
-
SHA512
3966c3c9d2ba55c87842fcd00c6eba9f62c4cabb5566d38b62a23cdbaf4093c3396c452d23bbeef3f899c72cf044e5a60c37ef7f3c96d13a716760a822e8d109
-
SSDEEP
12288:4y3H4t6Go5b/iG+cfRTdRn4jjHtQWRZmWpt46cZ7lwDPUHgJ/C0sxZbkroce:4y+c3+mTdRIjtnLH67lwDPq8/CVZYLe
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6708321519:AAH9WPgZQN8mlLl2zn6ccUEu4DYMqGCeTcQ/
Targets
-
-
Target
ordinul de cotatie.exe
-
Size
670KB
-
MD5
ed3815b037a3f57bfc35bc4b6c97c3a4
-
SHA1
034cded1a5c78337d11a3b4a0f9b62c270b51862
-
SHA256
bf2117027a187100dc80baf714dac0341c8f18fdd5e562248c43685ac0ceca29
-
SHA512
35a733c79702faf74ffed972eb2e2aef139713a4306634c4f3adb9ca6f9667442af24113efb23e1289ab66d64f02ce56e2406d3df98a52806a63ae90321b11ca
-
SSDEEP
12288:e8EMgXHfAhdhdSsLjQ05GzUPCLDMtUNGQeLq06ShFVr1KFABkeXOaId:e8jgvAhXfQ05Gz3LDUmnAqYjfXXOaI
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-