General
-
Target
SOA.exe
-
Size
1.1MB
-
Sample
221205-r4457adc41
-
MD5
6f25499ad6b017ad43a77020301727e2
-
SHA1
169eae0a1c12b68228682056a96cf6ec908ebc0c
-
SHA256
94871247351c446a6b3611837028785dae07c0db7403482f7a604dea29896afb
-
SHA512
0934165705e7408c0309dc36fe1f9bbcfc1f34f8525c3c4693578f75b0fa7ffef861ac6ade3627ea494491015aa3a46d5c95dbaac4a00765e7b8d860fcc18df2
-
SSDEEP
24576:ET7gqlKHw+maysf3dJLwWUrcd9T27JU2jfOFysjEodpE:U7gkJmfPsWOS2lljOFyCd2
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
SOA.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.biateknos.com - Port:
587 - Username:
[email protected] - Password:
biateknossutinah - Email To:
[email protected]
Targets
-
-
Target
SOA.exe
-
Size
1.1MB
-
MD5
6f25499ad6b017ad43a77020301727e2
-
SHA1
169eae0a1c12b68228682056a96cf6ec908ebc0c
-
SHA256
94871247351c446a6b3611837028785dae07c0db7403482f7a604dea29896afb
-
SHA512
0934165705e7408c0309dc36fe1f9bbcfc1f34f8525c3c4693578f75b0fa7ffef861ac6ade3627ea494491015aa3a46d5c95dbaac4a00765e7b8d860fcc18df2
-
SSDEEP
24576:ET7gqlKHw+maysf3dJLwWUrcd9T27JU2jfOFysjEodpE:U7gkJmfPsWOS2lljOFyCd2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-