General
-
Target
16102024_1343_16102024_Order No 2002902 inquiry for export to Thailand 20241016.gz
-
Size
504KB
-
Sample
241016-q1jveasdla
-
MD5
2926f8499bd13d74fd4c52f2260b3a62
-
SHA1
fb3fe10c6833665c0780f1d98a64031585e0d5a1
-
SHA256
4fd39a62badcf0f54086b8b11fd19d8e30e2ee635465fb7be6cc17beb29101b1
-
SHA512
87d6d6f33455bc96816388700d04238e10cda14f4e37d48f1ba73ad0525b34e7866747aebb81f9d3d3ecba2dce364783964276b709926f96040510f688f79894
-
SSDEEP
12288:SjCr2NtOYwAouC/1nx9FOfe2SudX9aJKgIpFiMp1HVWzUf6i:4CaNtHo5x2e2SKNaJtIpdBWzUfL
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Extracted
Protocol: ftp- Host:
ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Targets
-
-
Target
Order No 2002902 inquiry for export to Thailand 20241016.exe
-
Size
940KB
-
MD5
f1310f2ff30cb3fb3e1d037c2dccea90
-
SHA1
f005113ccca4ce88ff1799a02b218846e4a6f69f
-
SHA256
0841fb4737579f6fa91c3b9a6d0f5fe1b73f459f4b240a51123c3eff6f064cad
-
SHA512
c17259215e9b58ea3dae875fd42775ebbd38ecc582d4359956e14a10b3501489b0c1a9e640ad035eff8a8e1c8a377a69f4724a3a3144f2b5f2e4c4a4b255088e
-
SSDEEP
12288:PxK395tBOMVj0Gth54WDtQd33L65xOfIrcR6k29sfFE4TUm1P:PVkFdDad33LLIrJkNFE4ht
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-