General
-
Target
f4908766950c2bec2de45c61e11fa08b.bin
-
Size
707KB
-
Sample
230825-cemghsab6t
-
MD5
e33ef6a2df0bff5021eeed2dd035edb4
-
SHA1
7ec5b4def574ad15af6fda1a3f834432cdb4dffe
-
SHA256
5789e94f71ad33b43c757c1843323c4b5afa8d68906fee5a383ec14bce46f883
-
SHA512
3b73e09f3424bd5cf90cdc630d89740592b7fcf0e5cc11848d1c19db3848b29b00648bd8adea0112c6c273ebe9e7eb38d8e4379314680bc5e40f108fa328b8f9
-
SSDEEP
12288:cAjhNkoW3x32tvr4qh53YDjhSf+VlAEDUo3olB2KYb+j0P4XaJGKpjK/4239uwZD:cAjQx0D1h53Y3hnj1U/Yb+jaIEE39u+D
Static task
static1
Behavioral task
behavioral1
Sample
c7464a9c462386c00041d6afed11e2204d064bc83bce45275b4496b54c92083d.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
c7464a9c462386c00041d6afed11e2204d064bc83bce45275b4496b54c92083d.exe
Resource
win10v2004-20230824-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.parivartansandeshfoundation.com - Port:
587 - Username:
[email protected] - Password:
Man84Book!@#
Extracted
agenttesla
Protocol: smtp- Host:
mail.parivartansandeshfoundation.com - Port:
587 - Username:
[email protected] - Password:
Man84Book!@# - Email To:
[email protected]
Targets
-
-
Target
c7464a9c462386c00041d6afed11e2204d064bc83bce45275b4496b54c92083d.exe
-
Size
896KB
-
MD5
f4908766950c2bec2de45c61e11fa08b
-
SHA1
45b5016dad208113ea3b810f6aeae25e1431d848
-
SHA256
c7464a9c462386c00041d6afed11e2204d064bc83bce45275b4496b54c92083d
-
SHA512
ccd92d6d782b21a335c4c578d1e8c3fda4db8458f7443c57fd1b2da2e396b94d8249e812733e4acff51943b13b7153c907fad94f6f509d93146da90b63ef5feb
-
SSDEEP
24576:HLPcfpq41UXVMXzEfU89GFC7VPw5sYwxpKJ:KpqCC+XzEsSRZIiy
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-