General
-
Target
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069
-
Size
708KB
-
Sample
221206-hfsyksce82
-
MD5
3973d65313ddda73d13f1d170e7a42af
-
SHA1
c5afa670719fcf48dfd5552925e184a3ba227d4b
-
SHA256
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069
-
SHA512
cae564d0703e49b2613dbeff0ec1be1a796e092283b2e4db3663e53a66a71d3247a09b8424af5d1173262992a09b744ac475e50d3ceb7546917d83f4645e21dd
-
SSDEEP
12288:wBXa5k7Tu3XDG2KtsL+qqE1fB6KMebd7O5gwdezYJHTyU6rs47sdiGlmJb:Ma5S4G2KtA+uNMWdiawMkzXus47sIGlg
Static task
static1
Behavioral task
behavioral1
Sample
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.personaltrade.by - Port:
587 - Username:
[email protected] - Password:
Leto!Leto1
Extracted
Protocol: smtp- Host:
mail.personaltrade.by - Port:
587 - Username:
[email protected] - Password:
Leto!Leto1
Targets
-
-
Target
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069
-
Size
708KB
-
MD5
3973d65313ddda73d13f1d170e7a42af
-
SHA1
c5afa670719fcf48dfd5552925e184a3ba227d4b
-
SHA256
0927ab46092b483d9ff5546e54de2b907d36287fd2ca1c7450eae9f77f680069
-
SHA512
cae564d0703e49b2613dbeff0ec1be1a796e092283b2e4db3663e53a66a71d3247a09b8424af5d1173262992a09b744ac475e50d3ceb7546917d83f4645e21dd
-
SSDEEP
12288:wBXa5k7Tu3XDG2KtsL+qqE1fB6KMebd7O5gwdezYJHTyU6rs47sdiGlmJb:Ma5S4G2KtA+uNMWdiawMkzXus47sIGlg
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-