General
-
Target
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f
-
Size
611KB
-
Sample
240428-bjcmface92
-
MD5
90ef1b43841cec6ada8456d6001cdfab
-
SHA1
f4883709e25e8214a514a5a857d271ed522e2d1e
-
SHA256
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f
-
SHA512
a64011db120874c49e0fa96cb56c2fe7be520654cfcc45a200f673185911d0d9936998e969f436310ad025fd191fe3901fc60669f9a50a53e99a4c92f1899b4f
-
SSDEEP
12288:3yhaWvkOpKFP5eJBXY2PYMK2A4x3t45Jb+uh1ZaxfJz1+Ce5x5udkBuuQRo:3yXoh6Rwyxt45Jnjaxf11kMLuQRo
Static task
static1
Behavioral task
behavioral1
Sample
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
terminal4.veeblehosting.com - Port:
587 - Username:
appo@kailmaticarbon.com - Password:
Ifeanyi1987@ - Email To:
deepocket@eleven-end-sun.com
Targets
-
-
Target
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f
-
Size
611KB
-
MD5
90ef1b43841cec6ada8456d6001cdfab
-
SHA1
f4883709e25e8214a514a5a857d271ed522e2d1e
-
SHA256
ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f
-
SHA512
a64011db120874c49e0fa96cb56c2fe7be520654cfcc45a200f673185911d0d9936998e969f436310ad025fd191fe3901fc60669f9a50a53e99a4c92f1899b4f
-
SSDEEP
12288:3yhaWvkOpKFP5eJBXY2PYMK2A4x3t45Jb+uh1ZaxfJz1+Ce5x5udkBuuQRo:3yXoh6Rwyxt45Jnjaxf11kMLuQRo
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-