General
-
Target
LISTA DE COTIZACIONES.IMG
-
Size
1.7MB
-
Sample
241010-nayjrszenr
-
MD5
efbb3f7794eefbccc4903d7ca93b18b0
-
SHA1
c9aabe512245defae4cb52c2bd43cd64c733f21c
-
SHA256
852f81942c2058c99160bc363058cce79bb2e4743d7d47b132ef32166d4f6230
-
SHA512
45c8253a819fcab2996c59f45f08920287fec2a316ec6c88cf3f8dc9b081eeeedc5753a16e4ddb1491239e7c51ec95a8365a74564026e04777f8c73003d51fdf
-
SSDEEP
24576:ffmMv6Ckr7Mny5Q63xhh7HtqB93t6cdfJar7ki:f3v+7/5Q63bhxqt6J
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Targets
-
-
Target
LISTA DE COTIZACIONES.exe
-
Size
1.2MB
-
MD5
590e0ddfe21156fd0106e3d1fa313bc3
-
SHA1
8753129596e5a8c52ba93104656c4580aef49902
-
SHA256
3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e
-
SHA512
f62b8c0d9c0972353ef3c22290ed9724d9516604aa4e50b7a4762304e23384de01381d033afddae875ca7d2f7411c359b572504ca835ba2580fbbe58160b078d
-
SSDEEP
24576:WfmMv6Ckr7Mny5Q63xhh7HtqB93t6cdfJar7kiL:W3v+7/5Q63bhxqt6Jf
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-