General
-
Target
Statement Of Account.pdf_________________________________________________________________.rar
-
Size
536KB
-
Sample
231004-t8e3zada9z
-
MD5
d313c816700fc2e13615b7ce4cf237b9
-
SHA1
16f4d2c2c1db157010d8eced6f832b973767a383
-
SHA256
8a1b33e09071cee9982a8a460b288462c7c873ec8a365347c0acc1bda456822c
-
SHA512
c94c11db704a1f1d96dad5dfbb20f7d24ed0811526a1dbf9b68d90322bb28c1a7269c41af683d0d92049656911ed69539f74e6ba43fdf409a3a0fc1252023d04
-
SSDEEP
12288:P5COMIcJA9XgZIzpIGiS1V4qLZ9e/XNVLFMmhHsM:PkReXrZ4kKvNV5zhHsM
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.expertsconsultgh.co - Port:
587 - Username:
[email protected] - Password:
Oppong.2012 - Email To:
[email protected]
Targets
-
-
Target
Statement Of Account.pdf_________________________________________________________________.exe
-
Size
578KB
-
MD5
f7659e75c69e47b6fd42687ed60390d4
-
SHA1
ab96112413731eb7601bd5168c358334c81e9edf
-
SHA256
c94c3741876b0ec763fa759b91c10d941c12626e84ef0d43c6c64cec7959f4f8
-
SHA512
5fe2b981c292a79c4c31917c330fd7bca33326b7b4fd5254efb07a1e40871b772ef15ed0198a7b68a7dc52db18ba83936cd1f85a5ba975d87c9e92f1c8c415f0
-
SSDEEP
12288:x8zS55mFzD8jtsA6TwAaRhF0ThzIfDaXworitkvpALaek6m+I2i:xf55qatsD8BRhiThz+DUpr1p+Nk6m+ji
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-