General
-
Target
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
-
Size
350KB
-
Sample
230207-bawc7abh7z
-
MD5
30de9fdf74e679696573f243be4b43e9
-
SHA1
013ab418dc36cef10bdafcacc65485a28b292484
-
SHA256
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
-
SHA512
a137e199ffb4ff001545dd9875571520f41abfb449de7b1435899ca42d133051edc6b7c6bd4309caacc8cfdf98e8c0d3f60241a496cbe74dcb2243a4d24b13a3
-
SSDEEP
6144:/Ya60B2kYIxjohyIZ9olobwMg0dFr8YrCS0CuneQL50jpjC7XM/FKKnojCqKQBg:/YyB/YwcYWkobwM5uYrP0zeCmjg7XMtR
Static task
static1
Behavioral task
behavioral1
Sample
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mgcpakistan.com - Port:
21 - Username:
[email protected] - Password:
boygirl123456
Targets
-
-
Target
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
-
Size
350KB
-
MD5
30de9fdf74e679696573f243be4b43e9
-
SHA1
013ab418dc36cef10bdafcacc65485a28b292484
-
SHA256
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
-
SHA512
a137e199ffb4ff001545dd9875571520f41abfb449de7b1435899ca42d133051edc6b7c6bd4309caacc8cfdf98e8c0d3f60241a496cbe74dcb2243a4d24b13a3
-
SSDEEP
6144:/Ya60B2kYIxjohyIZ9olobwMg0dFr8YrCS0CuneQL50jpjC7XM/FKKnojCqKQBg:/YyB/YwcYWkobwM5uYrP0zeCmjg7XMtR
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-