General
-
Target
DA0495F4D7111AB9FB752D9229413CF6.exe
-
Size
1.1MB
-
Sample
230327-wancssgf2y
-
MD5
da0495f4d7111ab9fb752d9229413cf6
-
SHA1
5a3a8c6ba706530fbcc419e52e2a74906d91016f
-
SHA256
cd313109ac0c4bf1ba813b880930620e41407b466380f107bf6c36644b7cce6b
-
SHA512
aa4b973a86d4190e11eab02728ba5d2f22113f6599b6df058d8c45f03b7c523a0a02069d2613fde10e8f82a8322e9643220b886c4b59db05b279fef430a7f809
-
SSDEEP
12288:/AuuSHVHBTA08TnebF0y07RU2OLkM1Q5n5fcGeKR4ZSWK6YqU90M7pQpQzsPf4M0:/x1H6eV022OwqkQyMA/xr
Static task
static1
Behavioral task
behavioral1
Sample
DA0495F4D7111AB9FB752D9229413CF6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DA0495F4D7111AB9FB752D9229413CF6.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.humanpower.vn - Port:
587 - Username:
sales@humanpower.vn - Password:
xlA}CL.(Jj8C - Email To:
brimax@ventadeasfaltorc-250enlima.pe
Targets
-
-
Target
DA0495F4D7111AB9FB752D9229413CF6.exe
-
Size
1.1MB
-
MD5
da0495f4d7111ab9fb752d9229413cf6
-
SHA1
5a3a8c6ba706530fbcc419e52e2a74906d91016f
-
SHA256
cd313109ac0c4bf1ba813b880930620e41407b466380f107bf6c36644b7cce6b
-
SHA512
aa4b973a86d4190e11eab02728ba5d2f22113f6599b6df058d8c45f03b7c523a0a02069d2613fde10e8f82a8322e9643220b886c4b59db05b279fef430a7f809
-
SSDEEP
12288:/AuuSHVHBTA08TnebF0y07RU2OLkM1Q5n5fcGeKR4ZSWK6YqU90M7pQpQzsPf4M0:/x1H6eV022OwqkQyMA/xr
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-