General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.3693.17465.exe
-
Size
809KB
-
Sample
221204-f6rgbseg7x
-
MD5
11244598a222f827476b34161b6c1322
-
SHA1
722914ac1d8b4b731595e5ffabf8ec5f65c7cc5d
-
SHA256
8b2b130f783c2c3d56658c2fb5d282b70edbd828d76faae5c44027c2f2a017bd
-
SHA512
01f1d4fb0a249871cb905e9c09f519657d8030934dfeedcbed56a055c4a50d1631a8145fbd8aa36ee6c239e3b1c0f372e59565ed3e1cd96d880baae29708d986
-
SSDEEP
12288:qQ556j+PnD2N7DhigEv4x8E5jk/ii4aoAT3HSkg586aWHff:H57PDehigs4Gfos3HSB5O8f
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.3693.17465.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.3693.17465.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.valvindo.com - Port:
587 - Username:
[email protected] - Password:
Erhanvalvindo16
Extracted
agenttesla
Protocol: smtp- Host:
mail.valvindo.com - Port:
587 - Username:
[email protected] - Password:
Erhanvalvindo16
Targets
-
-
Target
SecuriteInfo.com.Win32.PWSX-gen.3693.17465.exe
-
Size
809KB
-
MD5
11244598a222f827476b34161b6c1322
-
SHA1
722914ac1d8b4b731595e5ffabf8ec5f65c7cc5d
-
SHA256
8b2b130f783c2c3d56658c2fb5d282b70edbd828d76faae5c44027c2f2a017bd
-
SHA512
01f1d4fb0a249871cb905e9c09f519657d8030934dfeedcbed56a055c4a50d1631a8145fbd8aa36ee6c239e3b1c0f372e59565ed3e1cd96d880baae29708d986
-
SSDEEP
12288:qQ556j+PnD2N7DhigEv4x8E5jk/ii4aoAT3HSkg586aWHff:H57PDehigs4Gfos3HSB5O8f
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-