General
-
Target
4bb3c21c0896cf51218a7792b0d28f9bb470ea0e1e765f0123bd4c2b81149ddc
-
Size
637KB
-
Sample
241017-b6tt8swaqa
-
MD5
e9a60644569aabd37119e1f0cef38240
-
SHA1
41874feec2d9a522cf4d3dc3daa474c4f0d68127
-
SHA256
4bb3c21c0896cf51218a7792b0d28f9bb470ea0e1e765f0123bd4c2b81149ddc
-
SHA512
4391946e9fde879b0f68e77cc691cedb9513464ca788734188dd0235929e03383a7fd2b2d4decf9fc1b57aeffe71b0886f24b44adf252b2d72e3d6216ee03e11
-
SSDEEP
12288:p4yQ+6vKAR8ON9nk+8Jq4cX7Fxo7NTql7oaeDSh+Q1ikNbxOTOROLai:pzQ+I3fp8TS7FcqVpe++Q1i6cTRLai
Malware Config
Extracted
Protocol: ftp- Host:
wenhuahui.net.au - Port:
21 - Username:
[email protected] - Password:
ceeboi123
Extracted
agenttesla
Protocol: ftp- Host:
ftp://wenhuahui.net.au - Port:
21 - Username:
[email protected] - Password:
ceeboi123
Targets
-
-
Target
SwfiMessageMt103 $45,000_doc.exe
-
Size
1.2MB
-
MD5
476fb4775f14d9b1befa243e8e4bad0d
-
SHA1
7d1e24761ac41f3b8df68ec151b2954933923d58
-
SHA256
bb51d12b27aa47453f879e2ade5058f7c08c3db72915bbf74f3d925a1a4c6ff9
-
SHA512
bd5afca9c7986f3e09918d1bd5c67841d63e23174f0f3eba5d426810d586eaeb415f799e4208272eb2701b720943614623d99a8d0e4f12bca1166a4d0e5bdf64
-
SSDEEP
12288:AA94yYOoodIG7eVS7xFNJF/+KTCBktSMdPWsLlUqFU/3JrjWfeiu2cJinAYixFsO:7yyYAdIktBZn2Bkf8S43JrSbYsqe94l
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-