General
-
Target
5e1df644b72fa1ec915602b9a35b649ac02e76e7d1fd090566a0a323cbcb7511
-
Size
716KB
-
Sample
231122-mjfjwacd5t
-
MD5
80dd4f5d285c3a20602ba1c09d555d35
-
SHA1
4651a773a6906d3108889c573394552699ecf835
-
SHA256
5e1df644b72fa1ec915602b9a35b649ac02e76e7d1fd090566a0a323cbcb7511
-
SHA512
cdd7762fb21c9e10e6a603e0244c027d57c33a7e55abcdffeff9f8e96cbbf1bb54ad6f0d580512a4d741c3c07cb6f94f32a29fb00926a7013bbaaa68a2969053
-
SSDEEP
12288:KCfHy8ounwMgXmnJyZgu8I+QgawR5kwSrJM13PlKG5SF2h1MsALV9tp74:KCfFznwsJsEfQLMSru13PlKd0o4
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
amen@graceofgod@
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
amen@graceofgod@ - Email To:
[email protected]
Targets
-
-
Target
Commercial Invoice.exe
-
Size
654KB
-
MD5
f5ef3feaa81059611b79ded01b578486
-
SHA1
685d12179574018397fb979a55d80b111b8f5e3f
-
SHA256
143c6e7ae3ffbbb27ff67f0cae5b680b3851faa0c8879c1e892c6b7831675496
-
SHA512
c7c2670820641731fb07cdff5b0d0839a00ff63c832428de68ad0287c5c16f57996256a6359f978f0d2ef92cfb8701e94f670848da1b41538eaa3e202582bef9
-
SSDEEP
12288:yCfHy8ounwMgXmnJyZgu8I+QgawR5kwSrJM13PlKG5SF2h1MsALV9tp74:yCfFznwsJsEfQLMSru13PlKd0o4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-