General
-
Target
25e14638ee6c5b04008b3b50b99f576f.bin
-
Size
790KB
-
Sample
231119-brkysahb71
-
MD5
05f26e19cf9d633b8d86791415fd507b
-
SHA1
0070ffc7efbf8e45cd1a5ae00e8fc5ac205f165c
-
SHA256
e5aaddfc8b942c3042cf1b2ebdc1dbd9e9b812459cccf4c480984f95314e3bfd
-
SHA512
9b16e218dec383a845ecdd2a63fc66c4632efc8382e526f4fce9c18f07c90afe4578b59f197b709a0d9dd21d42163407f22e8984ff489f79a09af53ade0a31c3
-
SSDEEP
12288:yPfaBMzp9DvgTHWaRhno+B2U+MTAkziegrhmQPb3UY8HYd40+Yn:yPCBMz/bgTTnoW1QkIFme3jaYSYn
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
kex#-rHjHM4qKk52 - Email To:
[email protected]
Targets
-
-
Target
b78001c65caffc4ff2cf300a7b2c2924a00720b34a38e5d021d115dfa419cbd5.exe
-
Size
1.1MB
-
MD5
25e14638ee6c5b04008b3b50b99f576f
-
SHA1
5ee0d64b3f79aaa8cd62aa05d99cacc812a15452
-
SHA256
b78001c65caffc4ff2cf300a7b2c2924a00720b34a38e5d021d115dfa419cbd5
-
SHA512
758479ad8368d7023c683e845f0fdccb8425867b53cd13050319d30608172ce09fdeee74008960df6b797090d5ee7e8b21460cb11e108e27638cdb9e51bf9727
-
SSDEEP
12288:37dBa/mFiTEJ0+0OR8FCko7VOkILM/PgyiZc410j8y6Q6UTRPStxmVmiTPLR46qh:rbIHLG5iq4Ho6UTBStIwifR76Nt4J1q
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-