Rewterz Threat Alert – Agent Tesla Malware

Rewterz Threat Advisory – CVE-2021-20517 – IBM WebSphere Application Server Vulnerability

June 7, 2021

Rewterz Threat Alert – SNAKE Ransomware – Active IOCs

June 7, 2021

Rewterz Threat Alert – Agent Tesla Malware – Active IOCs

Severity

High

Analysis Summary

A new Agent Tesla campaign is seen targeting victims with malspam. AgentTesla is known for stealing data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. Agent Tesla collects personal information from the victim’s machine, steals data from the victim’s clipboard, can log keystrokes, capture screenshots, and access the victim’s webcam. It can kill running analysis processes and AVsoftware. The spyware also performs basic actions to check whether it is running on a virtual machine or in debug mode, in an attempt to hide its capabilities and actions from researchers. All the data it obtains is sent in encrypted form via SMTP protocol.

Impact

Credential Theft
Data Exfiltration
Information Disclosure

Indicators of Compromise

MD5

4a814df442bac80adc95a552acfe9cce
76a1600bced976aa26c84fab2265aeb6
05f8396a27e04690c1454dce0496d0f0
9ccfd50b1ca710649b7b46fe400f1976
bd3ebf2abde768d752bc90b871996888
5a89e27501df280ac00a09475da5c832
c93c429db9152f674a7980fb8935ab63
0de3fa22e412aa3f291e08efa40cf6ed

SHA-256

695cd4a2066470a1984d379d8fda17eda32e18527fcbf7fb7465dce81705d764
e0e7029bd031b16a61ab33365d8b1d897999606eace9f0c3f204b6d60008efc3
21fc0150968fecd4140867871a8e2ff538ff2647516ddfee5b96465583fcb614
620cc1435535cb1285da2836d9f9d9657e1729d178a296c2ca5a60d9e92484ac
6413bfe11d962866d306007489ae88c102a5550ef22f1a0ae69231d1a04964be
27ce5d7ccebd3f564c5b86a75b49f53ebd9ab20da409dd69f9cc495b3fe578c4
414df86dfdf80858f2ae157fa8777e3592ee832de08088b0de0a09db0eae821c
469efc04541dc37e7339026e65e1ae28559252e585bfb523e052ec8bc9aa066c
8c5130f5fc21e9ef7d7f78ed1e3627b4b1254cfd3f0f5d78b61b6d9e5cc0fc99
2f70434264cbad212e45db34f8ce6d64685f27aed92561b39adf16bcf4640b08
ba276e7974b28e41c22e239b85bc10401e45f11d5f0bdaa726dc1a1497932704
a2822ddd514c1b4e9582569c8730424d9febcf9cbcdef13e61a719a5ea6fc141
7da0081fcf1e976f448ee96d350a8b421544dc53167c63f24f8d919815269093
534f45f09886af1a09c0c2918aef0a3550f25f3e933355be888345e142919b4b
684f8c462498a169feb433536fce62fa6a76b638166c491067069c88a5814be6
90eb923f28520df1127f45411c7425c41751e17a04117894d19b12f88880d884

SHA-1

21cd0f5148fd3ac0fe9d94fef16de15f05d5b045
900b3a58705b50a3513a9f3d7a869c8f1bb21e74
c09cfcdaa5facecfbe79d21c84407049acc1cd06
0f3bad35fca58b1b848131dc852b48d21017c361
7aa59ffea808acc7a21ad0548c805ae8e8cb2e08
c7b892087f63bda56a1effd7331d1604380d85f7
aaf547195933e0faf47d529365ee24582ce2b171
fac2d2467838701f5cec9be5b80479d27692ef21

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your enviro