General
-
Target
5e165a00cd809f7605073d7c40eabc8d.bin
-
Size
546KB
-
Sample
230401-bxrcrafa78
-
MD5
b09bd27b7a38dad9b07d2213754b22e3
-
SHA1
d996986bbb86804871969daeda584e6698a92784
-
SHA256
123bcd8bf72451ba02af106f3777845f2c9a3162d0ebbc74da5cbd9617276ef2
-
SHA512
8c55cbb525757475ab90faff7c5afa5117a8105830e3981caf0d4fa196ec2987d8a0bdc56d7ade9a2411b6f5bf65a4f4ea9f0c00e95577b4356f6985571e5594
-
SSDEEP
12288:lTZykZUuiQ2jVHh+A/iQgUwgmDslVklsb+e7X7S:l9FUuiQIVB+lCsslVAsbLHS
Static task
static1
Behavioral task
behavioral1
Sample
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.servicesterminals.com - Port:
587 - Username:
kenneth@servicesterminals.com - Password:
zK2kveho - Email To:
kenneth@servicesterminals.com
Targets
-
-
Target
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a.exe
-
Size
657KB
-
MD5
5e165a00cd809f7605073d7c40eabc8d
-
SHA1
7d473fb5e61d0cfbbd168c88b8f9a85e83a0a125
-
SHA256
6869aea56b539fe8189237aeff9f338691b034ebbfce1688e0f05e080dc9fb7a
-
SHA512
69848cc7729ee9b763dfbeaae3dbd50bd944c7c0690f3e66be6c942bf5f9751b90c46e950db6c27ad0d31e685a7acf6a21494e42797be44ca8236419ec70feb8
-
SSDEEP
12288:SvCgELbEubK0iEvLnfZka63QGX12G8/CfRXzlmqdTrtp2oimOMt+5:STOG0iQnfn6AGX4PCflzQyttimXi
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-