General
-
Target
m16XClientn.bat
-
Size
60KB
-
Sample
240524-wcq7gaeb45
-
MD5
322ea0b2359b53869e96a92ce89f0d9e
-
SHA1
c175334e858e2e6761202e7546201b26faefb911
-
SHA256
9eb06cfb9cd881338d93b6e2cad6e6a4bd823c44d0128a047e85fa14f278e76c
-
SHA512
080bb6189372bf55e533923a8f7cad393ecaccccff23ce578efe7104cc76779320faa43aa6b27fc43e63e0ea15f246ff38fccc91b5ebe6c5d4476daabde38c8f
-
SSDEEP
1536:qHRDZwBvoIeYCOoeK9PlcXmmHaoifEJ0SzAw:qHRDZwRN0cXGcJ0xw
Malware Config
Extracted
xworm
3.1
134.255.233.93:7000
OXTS79ak3lwQUaDQ
-
install_file
USB.exe
Extracted
agenttesla
https://api.telegram.org/bot6840755276:AAHEhHpmlrUuXaIUnKpuniBmO-DaNx3tnLo/
Targets
-
-
Target
m16XClientn.bat
-
Size
60KB
-
MD5
322ea0b2359b53869e96a92ce89f0d9e
-
SHA1
c175334e858e2e6761202e7546201b26faefb911
-
SHA256
9eb06cfb9cd881338d93b6e2cad6e6a4bd823c44d0128a047e85fa14f278e76c
-
SHA512
080bb6189372bf55e533923a8f7cad393ecaccccff23ce578efe7104cc76779320faa43aa6b27fc43e63e0ea15f246ff38fccc91b5ebe6c5d4476daabde38c8f
-
SSDEEP
1536:qHRDZwBvoIeYCOoeK9PlcXmmHaoifEJ0SzAw:qHRDZwRN0cXGcJ0xw
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Xworm Payload
-
Xworm
Xworm is a remote access trojan written in C#.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-