General
-
Target
f686e6edd1cfdaf9e636d2e38f481a4c.bin
-
Size
1.0MB
-
Sample
230928-dhkyjaha29
-
MD5
2d23a26c2e070592396e10a0372eebcb
-
SHA1
1f4bae236f8b81548504d72d1d14408e1e153fd2
-
SHA256
0c23b63f046b04fb84f935b21f28ed14a8ff0e14909aa24756ce10dc391e3261
-
SHA512
c1a8a3df6935f37396bb870406af51adbe78e30ab943797579e94124e67efa23081536aeda770196e94e15679de0f2513407541b8710f046c45c7bba8e5a165e
-
SSDEEP
24576:yDKZq3E24vi9IikF+bHnDGYq4tnswnwXuC83vUFjz6oth1uwPB:QN+vMIAvBqdwA8fUFjz6aR
Static task
static1
Behavioral task
behavioral1
Sample
f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.product-secured.com - Port:
21 - Username:
[email protected] - Password:
2V8SHFwjad34@@##
Targets
-
-
Target
f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9.exe
-
Size
1.2MB
-
MD5
f686e6edd1cfdaf9e636d2e38f481a4c
-
SHA1
27c8dfdcc3635c5a2ce78fb5799b9e6a904cbb88
-
SHA256
f9d4a03b124e4e3f81270b666d996db400b89bc1b7ce64914e8295685794dea9
-
SHA512
d79597927b92c47d89f7ecfb0dcb56ac90c960a328ff0907af7d2625a7f406c40e85a41c0428ccba0a9bec8e258d27d308660308327178a9b7c2cdbe523a7ae1
-
SSDEEP
24576:EZ9L+UmOVerUV8NmnedPvQMI127uvjbim1ujUO4EVzY:EZpsAVnedPs1ZuIND
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-