General
-
Target
a0ec2329bfd9bc5a443ae42dcdd6afe0c11bf6f20ecd087e3b3f1c4350ce0463
-
Size
616KB
-
Sample
241119-byqgvazank
-
MD5
68f313fb763f3d4d281df7ec59cf3c08
-
SHA1
f9aabb572c41aab642bb04795fdbf4236731f4b8
-
SHA256
a0ec2329bfd9bc5a443ae42dcdd6afe0c11bf6f20ecd087e3b3f1c4350ce0463
-
SHA512
7d41be38750583d2986c650b0c2ba381722276cdf9f7ec7e56a28e1588d3be9f9d31e30a3ad6307ed6ada30150c6330eed2d706d2c21d3a985685fbeda5c90c9
-
SSDEEP
12288:4iaXrwcCZtBrILAZKpkBJlO7xsALg25aQBJRxNijCe6:LaX8ZtmLACml0sAxdbN6C9
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://cash4cars.nz - Port:
21 - Username:
[email protected] - Password:
-[([pqM~nGA4
Extracted
Protocol: ftp- Host:
cash4cars.nz - Port:
21 - Username:
[email protected] - Password:
-[([pqM~nGA4
Targets
-
-
Target
ship’s particular_pdf.exe
-
Size
641KB
-
MD5
21608871cdf04378f2a01bfa61c055bf
-
SHA1
33e3896a35cb10f7996fc4f512ed1c28fb9ac380
-
SHA256
19c2d992bb70d4c0fe0b353e809da3e22e365b7155580957f354ff7870378e95
-
SHA512
cb99a37bd1bf8289c99feec522f33af876b16a83a93f6232eb4e6ffaa4ad3ab3325577a71d43e4618ba327e3d5a236b0831c3f316c24843f1997b96efb2a6f22
-
SSDEEP
12288:4sAy/s0yI3HjuYD7WeY69jPN3OTIS3/qBPb+WFv8XIx1hFwn9:zTDuQ7P9h39SP2F8XIe
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-