2018-06-26 #opendir .net #malware Agent Tesla

#opendir .net #malware
https://myonlinesecurity.co.uk/fake-quote-po-acpmreagan-com-delivers-a-keylogger/
@dvk01uk says Agent Tesla

6/17 Quotation Order email

#open dir hxxp://ptpjm.co.id/id/

md5,82F0C02E321AC4FCE218EFDCABB4D75D
Company Quotation and sales contracts.zip

md5,8EB8B220A1648A081E32C6F3DADB55D1
Company Quotation and sales contracts.exe

interesting in-memory strings
0x177a050 (114): \??\C:\Users\Win10\AppData\Roaming\Postbox\signons.sqlite
0x177a1d0 (118): \??\C:\Users\Win10\AppData\Roaming\Thunderbird\profiles.ini
0x1783d6c (96): HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSitesUser
0x17cfcc0 (130): \??\C:\Users\Win10\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
0x17d0530 (134): \??\C:\Users\Win10\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
0x3671d18 (26): http://checkip.dyndns.org/
0x36c3814 (36): DynDNS-CheckIP/1.0
0x376f784 (92): C:\Users\xxx\AppData\Local\Temp\\tmpG550.tmp
0x376fc48 (20): URL:
0x376fc70 (20): Username:
0x376fc98 (20): Password:
0x376fcc0 (26): Application:
0x3774658 (142): type={0}
hwid={1}
time={2}
pcname={3}
logdata={4}
screen={5}
ipadd={6}
webcam_link={7}
screen_link={8}
site_username={9}
[passwords]
0x3877ec0 (38): Opera Software\Opera Stable\Login Data
0x387ba94 (156): C:\Users\xxx\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
0x3893a20 (144): C:\Users\xxx\AppData\Roaming\Apple Computer\Preferences\keychain.plist
0x38aabd4 (116): C:\Users\xxx\AppData\Roaming\Flock\Browser\\signons3.txt
0x38bf860 (13): Torch Browser
0x38c25ac (20): UCBrowser\
0x38d41d0 (13): SMTP Password
0x38d32e4 (258): HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\HTTP Password
0x3923b28 (72): HKEY_CURRENT_USER\Software\Paltalk\.
0x39294f0 (45): \SmartFTP\Client 2.0\Favorites\Quick Connect\


interesting .net code from ilspy
---------
object objectValue = RuntimeHelpers.GetObjectValue(Interaction.CreateObject("WSfcfdfdsfdsfsffffffffffffffccript.Shell", ""));

string text = Interaction.Environ(#P.#K("5g+BxFHXkdTcEM3cEGgk0A==")) + #P.#K("sscpRZTSpuugDgOvmaPPPu6b/X9gZRYeKcyavwZ3WPM=");


string text = "%appdata%\\" + #P.#K("iXIzM98Pjl/u+zlU/h5Dfl19cMP29BJLIWFLWajNT92OKqOYE9q1PcctiVmnH8Ed") + #P.#K("#rundl343l32.exe#");

Interaction.Shell(text3 + #P.#K("#thenwfol#") + "\\" + #P.#K("#rundl343l32.exe#") + ".bat", AppWinStyle.Hide, false, -1);

File.Delete(text3 + #P.#K("#thenwfol#") + "\\qJ1rx6zo0JWv6cXezCyOGQ==.bat");

s = "美国八零会家美毒";

NewLateBinding.LateCall(instance, null, "Save", new object[0], null, null, null, true);

Process[] processesByName = Process.GetProcessesByName("qJ1rx6zo0JWv6cXezCyOGQ== ");


string[] array2 = "ezhjOTczMzBhLTZhMTItNDM1Zi1iMTQ5LWZhOGU1ZDc4YjQ0M30sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{22dae603-24dd-400a-a051-7564eef2723b},ezhjOTczMzBhLTZhMTItNDM1Zi1iMTQ5LWZhOGU1ZDc4YjQ0M30=,[z]{22dae603-24dd-400a-a051-7564eef2723b}".Split(array);


int num = (a == "w3wp.exe") ? 1 : 0;


string text2 = "@1B2c3D4e5F6g7H8";