General
-
Target
XIN CHUN - SHIP'S PARTICULARS.xlsx.lzh
-
Size
691KB
-
Sample
240705-hav6rawfpa
-
MD5
f3cd7b580628b5988ab299907e577871
-
SHA1
b472b4582a09fbe8d846667f9ddcd6117e12c7ed
-
SHA256
b4dde5d4f3e92bfedf10aa14fefe83f70061645c3bd71b3e444ed5fd7f920bc1
-
SHA512
66107b6bdc80432d0ed42fca248299fc5e45fd6c9aa0221ba29f477d21e1ae487a4e6cd9c945685959f2c716baa374b3efa85385e2d72ad53adb1ae510db6914
-
SSDEEP
12288:C+Q+lCwHGNoLMd4IwMwciMkSFT7VKN3a2D1m0H7b7u+LVFI+SJH+4OzxP8p:Cl+ZHGNoLMdNhb1V4U2kgzXb0Lk6p
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
XIN CHUN - SHIP'S PARTICULARS.xlsx.scr
-
Size
737KB
-
MD5
213aae0e127c8e0052d764ea309a6f50
-
SHA1
976eb8fbc2e3d200b5d28aad15eeb5fa6feb4c88
-
SHA256
5c6b72522a65d2909448a40ba27e0a85f26e79a8d8f740540e3a57017ce2c7ce
-
SHA512
88b877936bb6c14c85c7f6604197838debfe3bf7dbfd23ba0258a324330672e8c1d00f2260c7903c6d8714fdbe16ab7cbb79003a4727103f833151fd7b7cbb48
-
SSDEEP
12288:fA+oJI1cJQLB0YTnGnylFpE/YcWy7CVH788Ncg1ZvZK8MtqNnxTeYdfLr:frx1cJ4BzzlFpEnr7mbtcg5Kvt2no6jr
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-