General
-
Target
SecuriteInfo.com.MSIL.GenKryptik.FYGA.tr.21466.8076
-
Size
960KB
-
Sample
221126-p2tkkagf9y
-
MD5
a0b2a10e84abe8930570103f841bcc75
-
SHA1
441c100f5467f1e7983b3e62119b60bb3cc757d7
-
SHA256
ebb86221b5c4336e8155321c3ef818e39e38c981227b768433d107ba6aa3bd69
-
SHA512
023c0e59dbdd9dd8f3b2e3ad99154942d651e7b3c3b498e25d957fb4b717dde7148a932bc1cfd1a4a9679889fcaa22de8b25d75ae14f01e12c3a25ef248794d5
-
SSDEEP
24576:EGU376CRkFg/IyXtBbvShFasPKhCX0sTLZeD1zBCh:2PkoXvSLSkzTNk1W
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.MSIL.GenKryptik.FYGA.tr.21466.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.MSIL.GenKryptik.FYGA.tr.21466.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.biateknos.com - Port:
587 - Username:
[email protected] - Password:
biateknossutinah - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.MSIL.GenKryptik.FYGA.tr.21466.8076
-
Size
960KB
-
MD5
a0b2a10e84abe8930570103f841bcc75
-
SHA1
441c100f5467f1e7983b3e62119b60bb3cc757d7
-
SHA256
ebb86221b5c4336e8155321c3ef818e39e38c981227b768433d107ba6aa3bd69
-
SHA512
023c0e59dbdd9dd8f3b2e3ad99154942d651e7b3c3b498e25d957fb4b717dde7148a932bc1cfd1a4a9679889fcaa22de8b25d75ae14f01e12c3a25ef248794d5
-
SSDEEP
24576:EGU376CRkFg/IyXtBbvShFasPKhCX0sTLZeD1zBCh:2PkoXvSLSkzTNk1W
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-