General
-
Target
NEAS.99d376b4afcda6983c0030431b264aaedcfc09d7b805fe0d3c372175695da8a8.7z
-
Size
628KB
-
Sample
231115-vlaqeaeb5t
-
MD5
93adaebacfd4300695efb1e39682d094
-
SHA1
e363ac01a4a01e58082ec26a743f7259eb43af4e
-
SHA256
99d376b4afcda6983c0030431b264aaedcfc09d7b805fe0d3c372175695da8a8
-
SHA512
5a51ca4eb8eedf00ffd7c7db94c33e9d71f0db24a462c8536543b32c974586de3bad2bf000c926fd7af0826bc730769d0307088fc9258d450200acd317afc840
-
SSDEEP
12288:ZiHrK58ISxJs6zsoGyNgToVq88H5E72e7lZTn+P1p+pWPNEz:um5Aqym0VcHi7Tvz+tp+4PY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
kex#-rHjHM4qKk52 - Email To:
[email protected]
Targets
-
-
Target
COSCO DN 5874 COSCO DN 5977 COSCO DN 6268.exe
-
Size
839KB
-
MD5
90de6be2a577363b08fcbf891cc65068
-
SHA1
666e611bd3278c3a36fa423242dca61197f109e5
-
SHA256
e5a39d95388a1324e37c31b9bc6a527941dd0c0736a0971ead7ec611474d2eb7
-
SHA512
d3cf302f68573726a871a25c5400022231641da858d327198f38bc352a2d2af7ad73706ef96d69bf0e081563c7231a7c134fcaad1b980f92d4de38838e0904a9
-
SSDEEP
12288:v5AFnSizWUGJsLzldFXNgTSBQ8S9F9Age7lZ3n+PcP7r9r/+pppppppppppppppX:RqSi7dXmOB09HAtv3+U1q
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-