General
-
Target
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f
-
Size
872KB
-
Sample
221125-k3v3kafc49
-
MD5
a80cc11115ee01130a95952d2556fde7
-
SHA1
d7974567a59a65f6ed55ff499150de2f069f02e2
-
SHA256
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f
-
SHA512
9a127436bf63046c2c9832d7a5c0b10c11f694572c33a528c7f64d73b60feeaa36dc72cffb9ea46b56e8a6e1ea2cd53e5fe998db9ea22ccc94923569393b43f7
-
SSDEEP
12288:or5JQJujQkoqtI8+6uTtVq7guWrWsgLngfuuvLspmwMwZZmtNZO7cJMuPMR+ur6q:K5JQKhD8FTtEgFnEqu4PeZQLauPXp
Static task
static1
Behavioral task
behavioral1
Sample
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
themanisgood
Targets
-
-
Target
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f
-
Size
872KB
-
MD5
a80cc11115ee01130a95952d2556fde7
-
SHA1
d7974567a59a65f6ed55ff499150de2f069f02e2
-
SHA256
66598898a7a8f085e2799e2fbd9ccff05db6db0c931fda324f24374b74ea7e9f
-
SHA512
9a127436bf63046c2c9832d7a5c0b10c11f694572c33a528c7f64d73b60feeaa36dc72cffb9ea46b56e8a6e1ea2cd53e5fe998db9ea22ccc94923569393b43f7
-
SSDEEP
12288:or5JQJujQkoqtI8+6uTtVq7guWrWsgLngfuuvLspmwMwZZmtNZO7cJMuPMR+ur6q:K5JQKhD8FTtEgFnEqu4PeZQLauPXp
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-