General
-
Target
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33
-
Size
821KB
-
Sample
221125-l57d2sdb6x
-
MD5
d35db88b2c20127d768d5258184ff3fc
-
SHA1
4fc478d20bea3aac8b8bdab2a2fbbb6c8cee04ed
-
SHA256
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33
-
SHA512
c232696dd0e7dd8d671de84c0f6115ca9536ea287327a928c52441c3fc5bafd18e7ae0c4bf673f0680572c625dbc2be73de02c129eae3e6cb06c3c11851dad88
-
SSDEEP
12288:WG2qjXUb9tm//NXYQkCIgWB3FgE7WZi9709qtykVdsIC3+zCfYbumbfm8Ot5ui0D:rFQb9QZWJzcY67fbn/dY+uYzTo5
Static task
static1
Behavioral task
behavioral1
Sample
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
ugoblaq007
Extracted
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
ugoblaq007
Targets
-
-
Target
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33
-
Size
821KB
-
MD5
d35db88b2c20127d768d5258184ff3fc
-
SHA1
4fc478d20bea3aac8b8bdab2a2fbbb6c8cee04ed
-
SHA256
56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33
-
SHA512
c232696dd0e7dd8d671de84c0f6115ca9536ea287327a928c52441c3fc5bafd18e7ae0c4bf673f0680572c625dbc2be73de02c129eae3e6cb06c3c11851dad88
-
SSDEEP
12288:WG2qjXUb9tm//NXYQkCIgWB3FgE7WZi9709qtykVdsIC3+zCfYbumbfm8Ot5ui0D:rFQb9QZWJzcY67fbn/dY+uYzTo5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-