General
-
Target
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f
-
Size
246KB
-
Sample
240429-bdngradh61
-
MD5
13a6b4d27f45e49787044bfdc6d0e623
-
SHA1
060eb0fb8345cbc9d708a629648221b7aaade158
-
SHA256
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f
-
SHA512
b563a62ab41e7265a9f27c036f23f78d740f0b8282e0e56cd3be456c1cf6945085222ecf8eec993cc9f40b260d3bfc1d8f9f0209a7217750c8c501edf4af3019
-
SSDEEP
3072:lVaiFEKayiqoJSGjc13SV14NpxLfzi5gjt7dCJI:l9EKayiqoJSGjcgX4lzzXZ7d0
Behavioral task
behavioral1
Sample
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cphost09.qhoster.net - Port:
587 - Username:
admin@80-80.online - Password:
admin@80-80.online - Email To:
support@80-80.online
Targets
-
-
Target
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f
-
Size
246KB
-
MD5
13a6b4d27f45e49787044bfdc6d0e623
-
SHA1
060eb0fb8345cbc9d708a629648221b7aaade158
-
SHA256
69210241d05b835c547d81700c564cb7a615f17d289f4258f4c5d901307b312f
-
SHA512
b563a62ab41e7265a9f27c036f23f78d740f0b8282e0e56cd3be456c1cf6945085222ecf8eec993cc9f40b260d3bfc1d8f9f0209a7217750c8c501edf4af3019
-
SSDEEP
3072:lVaiFEKayiqoJSGjc13SV14NpxLfzi5gjt7dCJI:l9EKayiqoJSGjcgX4lzzXZ7d0
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-