General
-
Target
MV TBN_VLS's DETAILS.xls.lzh
-
Size
643KB
-
Sample
240603-rsagfahd8t
-
MD5
7fc3b1a248f1314906b30e592016183a
-
SHA1
b4d362587c434bfb568dd979a9c8c29aa59a9b0a
-
SHA256
d96e585c1a15fae03a100cba556c68e0bb830d8efb87fd498bac735a9147b9ad
-
SHA512
3cae469671fef9947b689457db06261a34bea8609139fe77c09790125abc5ded021c331150c78b1eebca267c9c3bca9dd07b82cc09e96bdd0c34887bc31471fd
-
SSDEEP
12288:JhWJK7vdi8SGwp1XfdAycKCFMLFbOiSax36C7+4HgL4B3keMYBogt8+xQc:jzILGhyLCFMLl6C7ukBUeMs/t8Tc
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
MV TBN_VLS's DETAILS.xls.scr
-
Size
701KB
-
MD5
f837b18ae77cf2e191972bc723ee5ebc
-
SHA1
31f548b020ff5c73957dc74fc702574322e658c8
-
SHA256
28e686d3d4c2ca997fdabbfb88c07afc77920015217bd22d82f7b08334010044
-
SHA512
2203198e130abcfbae21c280512705cdc94352d5a3324fa1dd372caa5ad661c262c4f358a142e43e4d6603a079de5b851e5ea5e0d97abe95114b18d19e162312
-
SSDEEP
12288:PbxdKt/rFfa7FpQpWc8nNZQuGu8Qs7cyytHeVA4sas66mBHu8ecI2:zjKN5i7XQ8c8n0xdcyyQ1F72N2
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-