General
-
Target
04172d4b087c8dac6fdb91053b6b443e.exe
-
Size
628KB
-
Sample
221206-hw5bjsha8w
-
MD5
04172d4b087c8dac6fdb91053b6b443e
-
SHA1
1fdfab48af8c0c9044601b9ccdefdb26702b8aa8
-
SHA256
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204
-
SHA512
617ebf7ef2af8d2110acedd81dfdc1f3519e73f5352cfd5276ea14652b97115018bb022868dbbedf995cea02a67a3c3966eaa19a93e0935d6abcbeef9a8324b1
-
SSDEEP
12288:G+NEDj+9UI94nOGmFmiLXgHxW7mwItay/lmprFKG0yBBzXLxd:GPj+9iOGqXMxZwrUMVBdXLxd
Static task
static1
Behavioral task
behavioral1
Sample
04172d4b087c8dac6fdb91053b6b443e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
04172d4b087c8dac6fdb91053b6b443e.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hnxqezadblabdsss
Targets
-
-
Target
04172d4b087c8dac6fdb91053b6b443e.exe
-
Size
628KB
-
MD5
04172d4b087c8dac6fdb91053b6b443e
-
SHA1
1fdfab48af8c0c9044601b9ccdefdb26702b8aa8
-
SHA256
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204
-
SHA512
617ebf7ef2af8d2110acedd81dfdc1f3519e73f5352cfd5276ea14652b97115018bb022868dbbedf995cea02a67a3c3966eaa19a93e0935d6abcbeef9a8324b1
-
SSDEEP
12288:G+NEDj+9UI94nOGmFmiLXgHxW7mwItay/lmprFKG0yBBzXLxd:GPj+9iOGqXMxZwrUMVBdXLxd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-