General
-
Target
SecuriteInfo.com.Variant.Strictor.25322.24521.28210.exe
-
Size
824KB
-
Sample
230403-f51cvach97
-
MD5
1563a5093416c942b8e57455abcef664
-
SHA1
fcc95ab87d20ab43ed301bc53dbea6b208be4151
-
SHA256
9072096046bf04b2f07da98d57dea07374aeb85294ba21404dd81176839737e6
-
SHA512
15473528c82ab3d0f080ffcaeecf0db6a6e9122f156dc2a9c3707ec36c21365f8f5c82328de0ea3b23dd0d38015af3bcf9881e49f4170a6b0e6a666baf612ce6
-
SSDEEP
12288:ietzLwrgtxmu8vcO92H6PAOU8WNR7uz6VdTqoHkd6/Djc2KMffJo1mJxRHHE6mRL:OUtp83FYOKduGVI9dk0vMfJYOW
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Strictor.25322.24521.28210.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Strictor.25322.24521.28210.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
inhaler911@yandex.com - Password:
mymama911@ - Email To:
inhaler911@yandex.com
Targets
-
-
Target
SecuriteInfo.com.Variant.Strictor.25322.24521.28210.exe
-
Size
824KB
-
MD5
1563a5093416c942b8e57455abcef664
-
SHA1
fcc95ab87d20ab43ed301bc53dbea6b208be4151
-
SHA256
9072096046bf04b2f07da98d57dea07374aeb85294ba21404dd81176839737e6
-
SHA512
15473528c82ab3d0f080ffcaeecf0db6a6e9122f156dc2a9c3707ec36c21365f8f5c82328de0ea3b23dd0d38015af3bcf9881e49f4170a6b0e6a666baf612ce6
-
SSDEEP
12288:ietzLwrgtxmu8vcO92H6PAOU8WNR7uz6VdTqoHkd6/Djc2KMffJo1mJxRHHE6mRL:OUtp83FYOKduGVI9dk0vMfJYOW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-