General
-
Target
7d0b70c3d3d6cd0b948cfdf1d51018fc3f814455c79d2a2fdcdd94a93e8751eb
-
Size
1.2MB
-
Sample
240608-bmzalseh9s
-
MD5
3dfa2933b443bde7b9284982f77f7ec9
-
SHA1
5f6b4845e78d4376d1c1e895c223617c00459b6b
-
SHA256
7d0b70c3d3d6cd0b948cfdf1d51018fc3f814455c79d2a2fdcdd94a93e8751eb
-
SHA512
3a664b60911a7875669ac63d30cca8448e90581d19b7cf00fc8870a67829d22096328afd48710969e1c68fd2caa176d34adf92d10b007d8f70e5886793eed8ef
-
SSDEEP
3072:Irfr45ctwuEz5RPGN9AYA6ykDxSTlWoJl0ovJvWR46fJb7AD8z:Yr45ZZWHlA6w
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
coleoffice.shop - Port:
587 - Username:
[email protected] - Password:
RGQjHeTCy8d7 - Email To:
[email protected]
Extracted
xworm
5.0
178.215.236.251:717
0AVeWj1eTvHM3Un2
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680
Extracted
Protocol: smtp- Host:
coleoffice.shop - Port:
587 - Username:
[email protected] - Password:
RGQjHeTCy8d7
Targets
-
-
Target
IATA_ INVOICE_PDF.exe
-
Size
151KB
-
MD5
54904a4ff9fc7f5474baee96832dfdaf
-
SHA1
80dd7e2c900d9dbea5cafdc31344e325b0eef8cb
-
SHA256
0cc90b14e61ae3e0792a5f7dcdbcea78de9bbb2b619260bca1b1948b15917d60
-
SHA512
bb07f61260bffe75b42db2849ca34bc614337f1a7f329a754f5281db3d236ae51fce5e60d1ee51a509cc034199870e475506fd682d5e01071257e4ee85709a3e
-
SSDEEP
3072:Yrfr45ctwuEz5RPGN9AYA6ykDxSTlWoJl0ovJvWR46fJb7AD8zc:or45ZZWHlA6wN
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Xworm Payload
-
Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-