General
-
Target
fad70edf02f82e634cbb58fe2345e380a524d63d0798dd1200e9f56e2cce4cbf.rar
-
Size
779KB
-
Sample
231201-vsac8aea6z
-
MD5
87b9ffcbedf70a93ceeaece85d45728c
-
SHA1
53e499d73abad54739c479f203eda8119695c878
-
SHA256
fad70edf02f82e634cbb58fe2345e380a524d63d0798dd1200e9f56e2cce4cbf
-
SHA512
ebc976f845b53eb2a96dcc8f869d207858b4878c1a7ae698e080481c06deddb3d422c4d721989bd5d06b4e99cb143fe0d7531dace3ed0c85ead9da734b54e90b
-
SSDEEP
12288:zQvCD/CqSU/EYF8bVTlTLMt6LnQJih1D57XaFH1aue6M8fpAxaqd8:rTIUoTlPMsLQSg1poyWxVW
Static task
static1
Behavioral task
behavioral1
Sample
NEW QUOTE-XXXXXXXXX88589032177700.bat
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEW QUOTE-XXXXXXXXX88589032177700.bat
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cyber.net.pk - Port:
587 - Username:
[email protected] - Password:
Zain2357@ - Email To:
[email protected]
Targets
-
-
Target
NEW QUOTE-XXXXXXXXX88589032177700.bat
-
Size
1009KB
-
MD5
8e16ec48c40bfd51e6305c1b2f4e9fa8
-
SHA1
24991017d3088f6fc943e11df888591aa34e3055
-
SHA256
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1
-
SHA512
7bbad34c6a6f4d5e8316771ffbad11010d8527f3a713b53f115dfa98d2a7bbc6f4596503a3ada325cebe41d472d7e930311e3734f4f24fec8eb90170b2485eba
-
SSDEEP
24576:W39YCqk2eQc9YQqzQ2ZBLjXyRnMIT98ZsXBHbrQ:Nrk9OtZdzKnMLZ8ZQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-