General
-
Target
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0
-
Size
1.2MB
-
Sample
240429-bmvbnadh67
-
MD5
07ea618cbc24841e91d6d4cc0b77b705
-
SHA1
655f52717a97e5354c3ed60e9261721e6d9cd35c
-
SHA256
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0
-
SHA512
19cf818f6da9faca3fc566003f209aa9904ee40799bb2970eab5f70528001212b957331fd7bf32b9155cc5dec8d63ea7f4add27faf13ea94d2365804b9e55163
-
SSDEEP
24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaSubufW/rUc5:Zh+ZkldoPK8YaSubufW/rn
Static task
static1
Behavioral task
behavioral1
Sample
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
premium185.web-hosting.com - Port:
587 - Username:
send@htcehplc.uroener.online - Password:
cooldown2013 - Email To:
info@cfi-vn.com
Targets
-
-
Target
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0
-
Size
1.2MB
-
MD5
07ea618cbc24841e91d6d4cc0b77b705
-
SHA1
655f52717a97e5354c3ed60e9261721e6d9cd35c
-
SHA256
334db25548ce179faf980bcf4483ab16272a617a4cbfcb32b298441d0adb24b0
-
SHA512
19cf818f6da9faca3fc566003f209aa9904ee40799bb2970eab5f70528001212b957331fd7bf32b9155cc5dec8d63ea7f4add27faf13ea94d2365804b9e55163
-
SSDEEP
24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaSubufW/rUc5:Zh+ZkldoPK8YaSubufW/rn
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-