General
-
Target
17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab
-
Size
785KB
-
Sample
230207-a1bk2abh3t
-
MD5
aeca0aa59566b054ca9283cfc33e45a4
-
SHA1
6d2b05581244ca09de10fa011a2cde56caf499b3
-
SHA256
17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab
-
SHA512
8338a175dcb3aa4f3c638f9b617837c0defdb305b9835e09c336111540436da427d922e8b837f994227ee114c46d866a69ea6124ecc2d889ed1ef20226f754ff
-
SSDEEP
12288:rOrx7p58lCrd4gyQapWMswIzWzjzpzHvbBtvZY7zskIjqrMuRZaZ7Hwd1LMRuz+O:KrxN5IC54TWMKuzZ9RenquQOU8MP4mA
Static task
static1
Behavioral task
behavioral1
Sample
17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hnxqezadblabdsss
Targets
-
-
Target
17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab
-
Size
785KB
-
MD5
aeca0aa59566b054ca9283cfc33e45a4
-
SHA1
6d2b05581244ca09de10fa011a2cde56caf499b3
-
SHA256
17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab
-
SHA512
8338a175dcb3aa4f3c638f9b617837c0defdb305b9835e09c336111540436da427d922e8b837f994227ee114c46d866a69ea6124ecc2d889ed1ef20226f754ff
-
SSDEEP
12288:rOrx7p58lCrd4gyQapWMswIzWzjzpzHvbBtvZY7zskIjqrMuRZaZ7Hwd1LMRuz+O:KrxN5IC54TWMKuzZ9RenquQOU8MP4mA
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-