General
-
Target
f8db919f34a3d0adbab3adae4d5dd2f8992db2f25afec21bec5ca55650ddf583.zip
-
Size
779KB
-
Sample
230308-neqdysfh25
-
MD5
66cb1a4ff36f5c605324b7932bb5ac25
-
SHA1
e4a1c82e6c8e68d81088df16ab8f9ab85f788b2c
-
SHA256
7cd8363a09c339bbe1153b0a2992ce1fa48c8293f67bf27b008363b8e6a2b87f
-
SHA512
11c19a72c37c972eb70e3b86fff2deed6a3762aa4b16353363c722d31acd2e9fd8281872b53f61279bb4627c19ca01d8eb0ed914951f285bfb20e3a237facff6
-
SSDEEP
12288:fByx3R+sx6nZMFmA2nGsXvdlm63Fqeg82IdC6bYBH+P2glaPH77u:fByxBx6n6yGsXLm630egFBH5glaPH77u
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360
Targets
-
-
Target
AWB #3827747403.pdf.exe
-
Size
959KB
-
MD5
960953e9848501c8afad1b0dbfdd92f8
-
SHA1
20347baee4f16f123f9acf41ee00a4c86e258f32
-
SHA256
ed12b65c4ad6c7849a23e7e6f5b0cc6827af4dab8ff0eef24d78afd9f4bfec1b
-
SHA512
f0e30e5acc130073bc26c91d25865b0fa079ca7b15fac9357ad78769eff5ee2da16ff724f66b783669085fcf6118cc35fc10221f7c984aef75ee717a1864f0c5
-
SSDEEP
24576:YqWOqd2UhNLdYHHR3SBvZsM8LtncfOJT58:x/qLK34veNLVcfg
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-