General
-
Target
QUOTATIONS#08675.TAR
-
Size
936KB
-
Sample
241002-rrw9ta1cln
-
MD5
d93bced86d98e3aa13a6e4ff64316b88
-
SHA1
60ffc4838f576933b39e126442362111ed48e041
-
SHA256
58a6f7580b8c1b88f48711dd43f7892d0b9881367d5b38194e91e43525e6a8cb
-
SHA512
141940b5b244e235a5642a69afb2d590270b11bb12a838e6d1440de342ea4900b34619de4440c8bf81b8da204afaac5c5dc9b9eeb35d0c66bf18da7eb96ef425
-
SSDEEP
24576:VBCsN+5WAwsEjo/wvNo1747tUKEd//p2BU6iO84u:VwsN+5usEE/3187+KgHEe14u
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Targets
-
-
Target
QUOTATIONS#08673.exe
-
Size
1.2MB
-
MD5
d0bb7d340bff9aec49a0100c6bcefa92
-
SHA1
d69b9cbe92828988f0febbea845f24baf4c13734
-
SHA256
0dd6ddb0a8533acebc288eff371234e39347f9e304dcf168643699aefb9925ea
-
SHA512
74d9b4bf6d7e27e576157aab0dc70b905244495f6b44875ad4136d73d8b55a34e8b1052b9f047fe5499333427154f5ee743d1c511f3ae1688871a234b15900fa
-
SSDEEP
24576:+Y2wkacr0/40yb/UG7r2+u16V3aKF7Qvww:+YKtrHT4EV37p
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-