General
-
Target
417598c79d3ab03c3e7dda9d7c3278db43dc2af7a8823016d6c737a716005817
-
Size
9KB
-
Sample
221207-jvh8csca3x
-
MD5
b1171241b48005c847a23c77234243a5
-
SHA1
085a49fae5242224dd1db5e0d07f685717d4e734
-
SHA256
417598c79d3ab03c3e7dda9d7c3278db43dc2af7a8823016d6c737a716005817
-
SHA512
473d833c9c2d5462a3cd18e84568e0c38de1d19fde0d6641fce311aca12fc704251a246f538846209106be3af99663b6886d7fba5f80535413d232057cfe0f76
-
SSDEEP
96:mfYbmOfZ3fwbo7yA1pwF3Nhu5Ip04dLy6s0D7ekYzP/zzgRVMQkGgizNt:7aOJ1fwjvp0ALySukYzHPgRVMBlE
Static task
static1
Behavioral task
behavioral1
Sample
417598c79d3ab03c3e7dda9d7c3278db43dc2af7a8823016d6c737a716005817.exe
Resource
win10-20220812-en
Malware Config
Extracted
agenttesla
http://cletonmy.com/apos/inc/b0c5a8117cbdaa.php
Targets
-
-
Target
417598c79d3ab03c3e7dda9d7c3278db43dc2af7a8823016d6c737a716005817
-
Size
9KB
-
MD5
b1171241b48005c847a23c77234243a5
-
SHA1
085a49fae5242224dd1db5e0d07f685717d4e734
-
SHA256
417598c79d3ab03c3e7dda9d7c3278db43dc2af7a8823016d6c737a716005817
-
SHA512
473d833c9c2d5462a3cd18e84568e0c38de1d19fde0d6641fce311aca12fc704251a246f538846209106be3af99663b6886d7fba5f80535413d232057cfe0f76
-
SSDEEP
96:mfYbmOfZ3fwbo7yA1pwF3Nhu5Ip04dLy6s0D7ekYzP/zzgRVMQkGgizNt:7aOJ1fwjvp0ALySukYzHPgRVMBlE
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detects Smokeloader packer
-
Executes dropped EXE
-
Deletes itself
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-