General
-
Target
eaf2b6671ec5dded98f2a7fe6aa603c7.bin
-
Size
1.1MB
-
Sample
230928-c7p34sgh57
-
MD5
b8ef1f715f78ccc4aa583812ee6b6f4d
-
SHA1
7b7032ac3e545af65c2480578e7263fc80d4aef6
-
SHA256
da03dfd3132630a0db051f2859d9a93070ad5f898d45fd257e37ff2fccf5ca26
-
SHA512
c79734a9952d98cf055f4058e67c2dbaaa6c157c44592ad3d4dad2f3963aecd163a1e5bb58e4de56f81984414e0edaea6f820abdbf3ab5cf0d2f664c19321042
-
SSDEEP
24576:hKvKPPFIaqPqy7xLFq1ltrULYIZgopLVDwTSjInMGN+2O9Ke8:hKvueV57xLIztgMIPLVMEInMGt
Static task
static1
Behavioral task
behavioral1
Sample
2dfe662fdf9cdb98f44cb0307188837be6b3e8aacace0b1725b95def11519dc0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2dfe662fdf9cdb98f44cb0307188837be6b3e8aacace0b1725b95def11519dc0.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.royalcheckout.store - Port:
587 - Username:
[email protected] - Password:
esubwDViXlQ2@@##
Targets
-
-
Target
2dfe662fdf9cdb98f44cb0307188837be6b3e8aacace0b1725b95def11519dc0.exe
-
Size
1.3MB
-
MD5
eaf2b6671ec5dded98f2a7fe6aa603c7
-
SHA1
cfc3b9d144916a24f89219487abaf3fe33c6eb11
-
SHA256
2dfe662fdf9cdb98f44cb0307188837be6b3e8aacace0b1725b95def11519dc0
-
SHA512
421a8ee4412c17f7325f0c895e23c89afe19eb0db17a866678043442f94e4117281e69eb80f708eeb473039b3b5da576e84c1b59946123bebe1b20eede17a20e
-
SSDEEP
24576:dA86BOzKx1EfrvUYZCVZTui+e0+rEITX0BZMnjYtpISZOnzwp:dioWvEYVVZTSB+rEITEBZMnjYjZc
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-