General
-
Target
6da2529b6ab3585b2b191c2b2b28d4c432a75baa691ff2df1152b05332ee64b6
-
Size
760KB
-
Sample
241013-layhnayfrc
-
MD5
f539b8b56ce43221a033638fe7a82e93
-
SHA1
c732a2e5c917f0bbd96e691202b160cce764d982
-
SHA256
6da2529b6ab3585b2b191c2b2b28d4c432a75baa691ff2df1152b05332ee64b6
-
SHA512
de89f1bff62e03afbc1480b6cd3b0897e991338de816e628bc93d69032e7e10763672eb11488ffca01782f3f1b25b030ee25b348f4b224cdb618239f5d39e4b3
-
SSDEEP
12288:o6wjUuCE/YKOtH3ViimeCKWVuxw4Y17SypZxPufx4u2CKGbBfIuRGSX8Ar9mbpJX:oPjfYKO13GnKAuxZSHDsl0Gb2KGSpaWO
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Targets
-
-
Target
QUOTATION#5400.exe
-
Size
1.1MB
-
MD5
c2d989a867f925afc6940a7bad9aedee
-
SHA1
111b0b6612f6a095815d5d73c85c703eacc39702
-
SHA256
1d789cde86d7ca676b8897c2de561e20f61bd9cdd708be9da7a2d9304df0ee02
-
SHA512
902b549b97f6e005386dfb29b0e31f29541a15c7ac8fcfb4ca1b05697be4084ddf705a4d9629df23804c1b254396576d3677d32728d71f67696eb67673b52d74
-
SSDEEP
24576:WfmMv6Ckr7Mny5Q6SfQVZj/8gzyALrh+XyD7eV:W3v+7/5Q6SfQb84h+CD6
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-