General
-
Target
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204
-
Size
560KB
-
Sample
221207-fap9dshd3v
-
MD5
47ea48af0814ccc6fa6bdfd2c28fd99d
-
SHA1
fa3bb873c47f6cbe0276743589437466ca9d8c39
-
SHA256
66be27344157e71ae32ee1f845b423444ea4cc5e495f81cb71eb25325e8838fa
-
SHA512
72e65397d7b4a1845407f21f8c18fa138f4072eb584db10e17ae71de7732cd1709e25b3c7e8eea8d33dc730b40785ba2dc3b6ac49bf8bdb46fd3026fafb5c82d
-
SSDEEP
12288:RkKN9Um9cjO42FMeLXg7xWhmwIta0/jmp9FKG0QBBzX6d:ue9wO4KXGxpwryaHBdX2
Static task
static1
Behavioral task
behavioral1
Sample
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hnxqezadblabdsss
Targets
-
-
Target
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204
-
Size
628KB
-
MD5
04172d4b087c8dac6fdb91053b6b443e
-
SHA1
1fdfab48af8c0c9044601b9ccdefdb26702b8aa8
-
SHA256
397e51f9b8a9a61de32f21b12d23334dca268c256d9024cfe4fb3605bd9c4204
-
SHA512
617ebf7ef2af8d2110acedd81dfdc1f3519e73f5352cfd5276ea14652b97115018bb022868dbbedf995cea02a67a3c3966eaa19a93e0935d6abcbeef9a8324b1
-
SSDEEP
12288:G+NEDj+9UI94nOGmFmiLXgHxW7mwItay/lmprFKG0yBBzXLxd:GPj+9iOGqXMxZwrUMVBdXLxd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-