General
-
Target
MEPS-42.exe
-
Size
779KB
-
Sample
221129-labnwsfa47
-
MD5
d7ef3266f37151f64ba446c1edcdd779
-
SHA1
1b7c6b50f3b85943ce13eb1bc3c00de89dc9b76f
-
SHA256
9fafe0f757cd03424b2314164d0ddcc120a75b38d69e41b8350c4f1b6c6092b7
-
SHA512
41eea8d14f92995339ed0451d566f36946c73f15c2beeed0e18d99887a65483849807b58dca4e32fd675284637fe25ed184892463adf3b2556e7c9a92fba987d
-
SSDEEP
12288:VLVDcgFr5cE8LHWQN1bTK5GaqqFWzleM4k/BHGOUY+NGO/SEdRMA/LyzIPPPu6gt:wjvLLbTaGVjpOiBHGCi9/LkInst
Static task
static1
Behavioral task
behavioral1
Sample
MEPS-42.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
MEPS-42.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.chroasia.org - Port:
587 - Username:
secretariat1@chroasia.org - Password:
Bhatia_rl123 - Email To:
djsmiley0055@gmail.com
Targets
-
-
Target
MEPS-42.exe
-
Size
779KB
-
MD5
d7ef3266f37151f64ba446c1edcdd779
-
SHA1
1b7c6b50f3b85943ce13eb1bc3c00de89dc9b76f
-
SHA256
9fafe0f757cd03424b2314164d0ddcc120a75b38d69e41b8350c4f1b6c6092b7
-
SHA512
41eea8d14f92995339ed0451d566f36946c73f15c2beeed0e18d99887a65483849807b58dca4e32fd675284637fe25ed184892463adf3b2556e7c9a92fba987d
-
SSDEEP
12288:VLVDcgFr5cE8LHWQN1bTK5GaqqFWzleM4k/BHGOUY+NGO/SEdRMA/LyzIPPPu6gt:wjvLLbTaGVjpOiBHGCi9/LkInst
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-