General
-
Target
TT Copy.exe
-
Size
678KB
-
Sample
230330-qex5xaec3v
-
MD5
49b64e415d7d80099fe079b57879e930
-
SHA1
202495e27168431afd0ce4e57eeca037acd784fd
-
SHA256
5ee727653b9e6ded021959d91650e3d23c1586b14ed1d22d84c8b3cd5f7e634a
-
SHA512
72479984aaa3b97c701bd97f5ceba2de9bc4fce17b95cfbe27719dd44569a4fdd8d3771a367941370abd4fd9bd7d1008d24c278f72ed827bc929406508ad7924
-
SSDEEP
12288:+eJ/sIU9Thtw2th1kfQe4fiGL0c4dwuS3iQRpS2Z5RzG1edBSj81tVimOMt+E:SHwqh1kIev40c43AiQ22zRzG8dA8imX
Static task
static1
Behavioral task
behavioral1
Sample
TT Copy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TT Copy.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rapidcheckng.com - Port:
587 - Username:
rapidcheck@rapidcheckng.com - Password:
@Rapidcheckng# - Email To:
ebukafale2@gmail.com
Targets
-
-
Target
TT Copy.exe
-
Size
678KB
-
MD5
49b64e415d7d80099fe079b57879e930
-
SHA1
202495e27168431afd0ce4e57eeca037acd784fd
-
SHA256
5ee727653b9e6ded021959d91650e3d23c1586b14ed1d22d84c8b3cd5f7e634a
-
SHA512
72479984aaa3b97c701bd97f5ceba2de9bc4fce17b95cfbe27719dd44569a4fdd8d3771a367941370abd4fd9bd7d1008d24c278f72ed827bc929406508ad7924
-
SSDEEP
12288:+eJ/sIU9Thtw2th1kfQe4fiGL0c4dwuS3iQRpS2Z5RzG1edBSj81tVimOMt+E:SHwqh1kIev40c43AiQ22zRzG8dA8imX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-