General
-
Target
CT12# TC-WI-60.exe
-
Size
714KB
-
Sample
230403-pncpwsef48
-
MD5
0c4a5ea1a54c5d7d4f25925bea591db1
-
SHA1
68ab63c2fcf21a369364bc80053c4a7ddb08dbe4
-
SHA256
9d99aa5e582b2b89947e9a42a1154b9ec2fe288463273851b213b61ff5f567ee
-
SHA512
7e838579bb21d21c0e4b68a53d9fe8b57dcc4302c98f88ec314ac9b30d2824ca60efb32d40d1c3694e931d6e243fa616ff98b92387a0f14202f577cb1e377b7e
-
SSDEEP
12288:F5CBWKdq1FbwwJLwrSdaV+6mR1V3oPYbd3JAzKAbbwy56tUDnyNHxWOjCvw9:ufrp+dSmRnz6whUuHxQ49
Static task
static1
Behavioral task
behavioral1
Sample
CT12# TC-WI-60.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CT12# TC-WI-60.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.canosgb.com - Port:
587 - Username:
[email protected] - Password:
Bk1963. - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.canosgb.com - Port:
587 - Username:
[email protected] - Password:
Bk1963.
Targets
-
-
Target
CT12# TC-WI-60.exe
-
Size
714KB
-
MD5
0c4a5ea1a54c5d7d4f25925bea591db1
-
SHA1
68ab63c2fcf21a369364bc80053c4a7ddb08dbe4
-
SHA256
9d99aa5e582b2b89947e9a42a1154b9ec2fe288463273851b213b61ff5f567ee
-
SHA512
7e838579bb21d21c0e4b68a53d9fe8b57dcc4302c98f88ec314ac9b30d2824ca60efb32d40d1c3694e931d6e243fa616ff98b92387a0f14202f577cb1e377b7e
-
SSDEEP
12288:F5CBWKdq1FbwwJLwrSdaV+6mR1V3oPYbd3JAzKAbbwy56tUDnyNHxWOjCvw9:ufrp+dSmRnz6whUuHxQ49
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-