General
-
Target
82eac28746d4afc030f2d6b91b61f61112dbd2e19c0d39a126ac94735b94fcbd
-
Size
610KB
-
Sample
240925-x1nxpasgqq
-
MD5
449b487e107ba6cedb893ab3ee628ae1
-
SHA1
168a336dae7872fb8c223db14153f229a32425e3
-
SHA256
82eac28746d4afc030f2d6b91b61f61112dbd2e19c0d39a126ac94735b94fcbd
-
SHA512
59b07124d7144202b7b2a17b2a726983c20f0de99ff4937faeed87d4be1fe8ae1f369e56c862caefa0c2357557f989e3fb02915f6dd07bf9ab1be280867ac578
-
SSDEEP
12288:4tMvbhIoVisNhgV9t1pFVDVYdjcU49HrIcIBpdBeUyjdmbqT/VP6:4tMvFzYV9tjFVaoDfuT4rj7/Vy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.claresbout.com - Port:
587 - Username:
[email protected] - Password:
fahaF^V7 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
smtp.claresbout.com - Port:
587 - Username:
[email protected] - Password:
fahaF^V7
Targets
-
-
Target
16XiVBqBiGijcOr.exe
-
Size
742KB
-
MD5
7bf2e216f8685b76795ebf59b481ec9e
-
SHA1
77a24fc0cdcdbf883c11396d54a753369b4655b2
-
SHA256
7bd23e8dbf430720561648492dd9604766a1c9023cf990ebae9415efb62b5a46
-
SHA512
58109e830bf82455e04b28a5b347d30514669280d188700fdbb2bf853fd300a69915df02966111a6e01d6c2450de8b9662cb68fe874974c846dda443ad486783
-
SSDEEP
12288:GosFcrWv/ncojiJcm6p+1kMediv7XlDkHJIWMR3d8U7S6ZURby:bsFcrWv/WRUjHiv7QnutY6ZURb
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-