General
- Target whatsappimage-bankcopy040726.exe
- Size 340KB
- Sample260709-pd2w2ahy5p
- SHA256 9c6be60162b611918d074da4f14322909bc031c74e66201219c23370423fcf91
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
ftp
-
Host
ftp://ftp.holzbrenzii.com
-
Port
21
-
Username
-
Password
@lilkooll123456
Targets
-
- Target whatsappimage-bankcopy040726.exe
- Size 340KB
- SHA256 9c6be60162b611918d074da4f14322909bc031c74e66201219c23370423fcf91
Score10/10Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Family: Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Loads dropped DLL
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
Score3/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2