General
-
Target
40475890fb594c22b45d11ae827cafe2.bin
-
Size
809KB
-
Sample
230331-bl52rsgb32
-
MD5
52979274bf80e07f9e66c26e95418f97
-
SHA1
8a8ed798b1b314c6d7938c34c6ce4116fdf49c6b
-
SHA256
744bd6d4e0a4f43b8faeb27416641d17b348c406463881ecfa2b60c4e43bfcd4
-
SHA512
542e0a8efb42cb5726c8ef58939d947abfa32394b309996a3c35e0bd058a0688ecf7d4c1038f979183b0fa5cef78931bbb5a47a68bbe9d31a8957debe85b5b31
-
SSDEEP
24576:fedgDDCw9Ydrs4EuoYtvKEN/khOqMDUP0Z8yuDY:fAgDDfusJ+rEXMDFZXuE
Static task
static1
Behavioral task
behavioral1
Sample
3bc2c61a0e15a16eb536081daadd7275600e57f0be74d284dc64ef64552e2cc4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3bc2c61a0e15a16eb536081daadd7275600e57f0be74d284dc64ef64552e2cc4.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
maggie.hualingan@gmail.com - Password:
hnxqezadblabdsss
Targets
-
-
Target
3bc2c61a0e15a16eb536081daadd7275600e57f0be74d284dc64ef64552e2cc4.exe
-
Size
1.0MB
-
MD5
40475890fb594c22b45d11ae827cafe2
-
SHA1
06cfcb11c8626d56bb80b1377545861a464e3c53
-
SHA256
3bc2c61a0e15a16eb536081daadd7275600e57f0be74d284dc64ef64552e2cc4
-
SHA512
7aadb242a42565ce936300f0f948e4d97d7a1382c54c0dca6543068fe8a17d21ef30f61a8ecd53ed15657a871eb4706728920926c6391cf8485517e0557ba45a
-
SSDEEP
24576:4r12zVZ97SymajTAwr2MZDIghH6HW6OuGy7q9Hmhybp:4rAR37S5avPIgha2xy7qmm
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-