General
-
Target
SecuriteInfo.com.Trojan.Siggen19.18804.2556.13559.exe
-
Size
746KB
-
Sample
221206-qt4w1acc79
-
MD5
cb1434a388b8440147cb3bf34cdf1895
-
SHA1
dfa203d571e69e74b7a945f2a05093adb0b5f9b1
-
SHA256
00c69d78bc5d6b95fdd71348537bf9b0e30d3f075ca03448fab414f4ad9425fc
-
SHA512
ee8eb233f4b38e059d7314bb7139bd14e9f8844635ab94550ee2e5d0095bb8d5e78a21f0adbc90a451c2cfcf8993134b4b09a5ba81258249916176ac48f374df
-
SSDEEP
12288:TwlxtmomPZef+PtqvyuxnATSRO8+LK71KMH9rZUXU+qaiKMYDDv/w:kgomxi+QvnA+EhDk9dUfbL3w
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen19.18804.2556.13559.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen19.18804.2556.13559.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.animaledzoocation.com - Port:
587 - Username:
[email protected] - Password:
777Snakes - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Trojan.Siggen19.18804.2556.13559.exe
-
Size
746KB
-
MD5
cb1434a388b8440147cb3bf34cdf1895
-
SHA1
dfa203d571e69e74b7a945f2a05093adb0b5f9b1
-
SHA256
00c69d78bc5d6b95fdd71348537bf9b0e30d3f075ca03448fab414f4ad9425fc
-
SHA512
ee8eb233f4b38e059d7314bb7139bd14e9f8844635ab94550ee2e5d0095bb8d5e78a21f0adbc90a451c2cfcf8993134b4b09a5ba81258249916176ac48f374df
-
SSDEEP
12288:TwlxtmomPZef+PtqvyuxnATSRO8+LK71KMH9rZUXU+qaiKMYDDv/w:kgomxi+QvnA+EhDk9dUfbL3w
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-