General
-
Target
IV22200102 31-03-2023.r15.rar
-
Size
443KB
-
Sample
230331-l9nshaaf8y
-
MD5
da43b5d3a6719e8bceb25771378491f4
-
SHA1
c90e043d3db7a73201a0e8ffb6f04e888030779b
-
SHA256
7c7f9ae1d71a95b779a925978f758b9adb405a4af9ed61741fe8837bd5dca4e4
-
SHA512
91a2e0f30d204b8af71396135da947b811248b24b234b5b20168fa80658d31d1a425dde963423b5cf85f87666e52c70947525ca1894bc30af921e9e2271c01d4
-
SSDEEP
12288:ajqW8kh5jms+uNXGmqeq4aB4QNTIKksi2GALK9:HkjmwNXLqey4gPkYK9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.exceltruea.com - Port:
587 - Username:
[email protected] - Password:
bl es si ng 2 0 2 3 - Email To:
[email protected]
Targets
-
-
Target
IV22200102 30-03-2023.exe
-
Size
677KB
-
MD5
9a73ed7acebb4aa4df0f6cb3f2c66881
-
SHA1
2273f16a60a07707d55c6697b63f52162d5fca8c
-
SHA256
285c3ffd2b6cdd180ee0a3371f12f6a0ffb4a77ffc7a811f242749f68722242c
-
SHA512
39407b0132fe24cd93fb9fa992c4e66090d0adb2132848648bf77237cc78c23d678f1bce9e948c6818554f7a214fc8f5e97f40533fb4b91477b80adb21287af7
-
SSDEEP
12288:kKPFSPlpTCyywVhs9PNSWPAoer7/iEUL07zMtk7R:kiFSnT0wVuDTrOxUL07zB1
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-