agenttesla

General

Target

RNSM00425.7z
Size

65.2MB
Sample

241027-tddawsxkaw
MD5

dabbff286a8d34b5350c7c612cb0735f
SHA1

18de8d3eae3a277552208dc6f99869229abf6b91
SHA256

b30e8c7eb1efc8302da7b9c95f361c4d4fe9bc0a620d83851fcaffd501145bda
SHA512

fb9cc4dc805c405fb18f8fc662e10134399937563cda7debe7c3699ad8a077f2b56204f1e130ba6cf6eaa960741c94afa80f4e27f7b6d9791b927bc8588b6bc3
SSDEEP

1572864:qSmj82NPdgwgTSOehA3nh/hgLvCaBBncoIJAfxh8N1Z:Uj8wPdBKchA3nlqBRzA

Malware Config

Extracted

Family

crimsonrat

C2

23.254.119.118

122.216.31.108

Extracted

Path

C:\Recovery\WindowsRE\How To Restore Your Files.txt

Ransom Note

############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe

URLs

http://babukq4e2p4wu4iq.onion/login.php?id=qrkurJuYkvPsMF4sX5avnaBrUHldGe

Extracted

Path

C:\Users\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��4E E9 BA B4 BE B4 C1 A1 09 BE 71 98 26 21 11 C2 67 AD 15 0D 31 9C 59 89 97 89 1C 10 50 9C AA 41 06 7C 97 29 68 78 AE 8A C7 05 7C 7E E6 0A D7 19 98 E5 3E 9C 66 C5 10 9D E9 8D 8E 16 8E 28 AB DD 28 34 C4 A4 DD 3D E6 9E 38 92 D0 34 F1 A3 B4 F0 B9 A7 32 85 87 F5 9B EC C9 9D 6C A0 85 F6 82 F7 20 8C FB A4 D6 10 66 3B 9F A3 F9 9D 8C 54 A9 A3 71 17 FC 87 5F E3 B4 06 64 36 A0 FB 57 5D 9F AB E9 2A 31 BA 1D C5 74 3F 0A 1B 01 89 79 0D 43 46 9C 17 B6 5A 3D 1E 40 6F 01 28 4D 87 CA 0D 2D 4F 91 83 88 36 F9 B7 77 1C F5 22 23 69 22 42 EB 16 45 57 BE 03 BC F8 C7 92 FC 60 A5 58 F1 B4 1F 59 E2 FD 72 55 6A 69 9D 82 DA 89 0F 3A F3 1C B1 41 81 AA 24 15 9E 59 BF F5 B5 66 C7 28 37 9E E1 DB 7B 33 0A BE 16 39 D4 92 49 7D 94 0D ED 70 88 DE 50 73 C8 6E 1F 66 78 AB AB C3 28 F5 23 C6 8E 05 </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☠ Your files are encrypted! ☠</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text">  To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span> [email protected] </span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> Decryption cost $ 800. Payment is accepted only in Bitcoin (BTC). No discounts !!! You can exchange your currency for Bitcoin in your bank or in private exchangers.</p> After payment you will receive a decryptor and recommendations to counter hacking your data. Decryptor will automatically recover your files within 15-20 minutes. <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>If within 24 hours you have not received a response from the support contact us: [email protected] </li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html> ��

Emails

[email protected]

[email protected]</li>

[email protected]

Targets

- Target
  
  RNSM00425.7z
- Size
  
  65.2MB
- MD5
  
  dabbff286a8d34b5350c7c612cb0735f
- SHA1
  
  18de8d3eae3a277552208dc6f99869229abf6b91
- SHA256
  
  b30e8c7eb1efc8302da7b9c95f361c4d4fe9bc0a620d83851fcaffd501145bda
- SHA512
  
  fb9cc4dc805c405fb18f8fc662e10134399937563cda7debe7c3699ad8a077f2b56204f1e130ba6cf6eaa960741c94afa80f4e27f7b6d9791b927bc8588b6bc3
- SSDEEP
  
  1572864:qSmj82NPdgwgTSOehA3nh/hgLvCaBBncoIJAfxh8N1Z:Uj8wPdBKchA3nlqBRzA
Score

10^/10

agenttesla crimsonrat xmrig agilenet defense_evasion discovery evasion execution impact keylogger miner persistence privilege_escalation pyinstaller ransomware rat spyware stealer trojan upx vmprotect
- AgentTesla
  Agent Tesla is a remote access tool (RAT) written in visual basic.
  keylogger trojan stealer spyware agenttesla
- Agenttesla family
  agenttesla
- CrimsonRAT main payload
- CrimsonRat
  Crimson RAT is a malware linked to a Pakistani-linked threat actor.
  rat crimsonrat
- Crimsonrat family
  crimsonrat
- Disables service(s)
  evasion execution
- XMRig Miner payload
  miner
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- AgentTesla payload
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies Windows Firewall
  evasion
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1