General
-
Target
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084_JC.exe
-
Size
1.3MB
-
Sample
231010-1m63wsfe43
-
MD5
84d3eb45f1ea15290edd4c40af005656
-
SHA1
0f092118064f45a43a9528d0cfd207f60bae65aa
-
SHA256
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084
-
SHA512
655b163fcf4d280c109a231d0494011acf9c3c641b5f6cd00c10f6a8165e16485cf8b14c1c634b403b76af9151030351a55b3a1e9189f18095760ff6d3a47979
-
SSDEEP
24576:qZTgNqg2CeDQ28rWgPamYVVN3LKF+8qRJg3ObFzPHY57DlaufYdTObyY:qKNqFCn2sLPamg10+8O2YjHYjaugdMr
Static task
static1
Behavioral task
behavioral1
Sample
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.product-secured.com - Port:
21 - Username:
[email protected] - Password:
575K5(MaZro2575K5(MaZro2
Extracted
Protocol: smtp- Host:
mail.product-secured.com - Port:
587 - Username:
[email protected] - Password:
575K5(MaZro2575K5(MaZro2
Targets
-
-
Target
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084_JC.exe
-
Size
1.3MB
-
MD5
84d3eb45f1ea15290edd4c40af005656
-
SHA1
0f092118064f45a43a9528d0cfd207f60bae65aa
-
SHA256
0802764e9152d0850b10d83d287ea83b6eb2654daed62d255803712f02fc0084
-
SHA512
655b163fcf4d280c109a231d0494011acf9c3c641b5f6cd00c10f6a8165e16485cf8b14c1c634b403b76af9151030351a55b3a1e9189f18095760ff6d3a47979
-
SSDEEP
24576:qZTgNqg2CeDQ28rWgPamYVVN3LKF+8qRJg3ObFzPHY57DlaufYdTObyY:qKNqFCn2sLPamg10+8O2YjHYjaugdMr
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-