General
-
Target
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f
-
Size
706KB
-
Sample
240427-b82b4ahe2z
-
MD5
4da6bcddf089abf04eec54f7d481a2a6
-
SHA1
0908d8633b04a4053f49439ff9d82db0dfec876b
-
SHA256
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f
-
SHA512
88dec65d71a3fd5f7dedc99de839b6b9bca45ef951e4b3967d1d98a442e70d9d752b34f34975ee2d33e4b0d9de8a069a96d55a01ebc80621ebca6a8ef81ee293
-
SSDEEP
12288:bNziswnkBwKwK7UqPhgqnOYg0vUJ1F40h:btisBGK7dyqnebh
Static task
static1
Behavioral task
behavioral1
Sample
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ba-theatre.com - Port:
587 - Username:
info@ba-theatre.com - Password:
juddba123 - Email To:
hectordalmasso@hdinmobiliaria.com.ar
Targets
-
-
Target
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f
-
Size
706KB
-
MD5
4da6bcddf089abf04eec54f7d481a2a6
-
SHA1
0908d8633b04a4053f49439ff9d82db0dfec876b
-
SHA256
1b1057274b162be5dfea419484c4590489b255db5d99adc7fce2c140ced3da0f
-
SHA512
88dec65d71a3fd5f7dedc99de839b6b9bca45ef951e4b3967d1d98a442e70d9d752b34f34975ee2d33e4b0d9de8a069a96d55a01ebc80621ebca6a8ef81ee293
-
SSDEEP
12288:bNziswnkBwKwK7UqPhgqnOYg0vUJ1F40h:btisBGK7dyqnebh
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-