General
-
Target
LISTA DE COTIZACIONES.IMG
-
Size
1.7MB
-
Sample
241011-rf9e1a1enr
-
MD5
ccf365a88b00721144d8487159db6902
-
SHA1
6a1f7b6a9d0f459f2dd3ec735718ed8ab12abf39
-
SHA256
1267245f150ed4a36ec231ec1b031891e84d593f48456afb99661032386f5810
-
SHA512
ed0cc4893d7038c41bd247ab4f06b3de3f04fc5c0fc3a60ac5b57b71da2d8a68b79d00a363ae69722e45ba6047616246bce0001bb77dc3cfb6927329bb00f16f
-
SSDEEP
24576:dfmMv6Ckr7Mny5Q6PMmLhkm6hV4BVuj+yi+x:d3v+7/5Q63hW4BoLx
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Targets
-
-
Target
LISTA DE COTIZACIONES.exe
-
Size
1.2MB
-
MD5
6cd1b709d4464b7232cece96f174eb14
-
SHA1
2180315cc36590883cf8769f126c1f0e09689c8b
-
SHA256
9ed02e320f8f4729f17503ab1b79c3bd9034059e2b0b6511fa437a9ce634bd9d
-
SHA512
1c895326e612c5818a8e3622303cd6c3ff5a08c573a8c12edc8247fb3b3b9510895566d5f29bdd9bb8da31dc8cb6368cb235bc0834bbca47a1aa597fe0b55373
-
SSDEEP
24576:WfmMv6Ckr7Mny5Q6PMmLhkm6hV4BVuj+yi+xk:W3v+7/5Q63hW4BoLxk
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-