General
-
Target
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1.bat
-
Size
1009KB
-
Sample
231201-whg6raed82
-
MD5
8e16ec48c40bfd51e6305c1b2f4e9fa8
-
SHA1
24991017d3088f6fc943e11df888591aa34e3055
-
SHA256
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1
-
SHA512
7bbad34c6a6f4d5e8316771ffbad11010d8527f3a713b53f115dfa98d2a7bbc6f4596503a3ada325cebe41d472d7e930311e3734f4f24fec8eb90170b2485eba
-
SSDEEP
24576:W39YCqk2eQc9YQqzQ2ZBLjXyRnMIT98ZsXBHbrQ:Nrk9OtZdzKnMLZ8ZQ
Static task
static1
Behavioral task
behavioral1
Sample
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1.bat
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1.bat
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cyber.net.pk - Port:
587 - Username:
[email protected] - Password:
Zain2357@ - Email To:
[email protected]
Targets
-
-
Target
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1.bat
-
Size
1009KB
-
MD5
8e16ec48c40bfd51e6305c1b2f4e9fa8
-
SHA1
24991017d3088f6fc943e11df888591aa34e3055
-
SHA256
8e065b09f518cdc94ede24c50ab9cb712ff54147b089e4267965462a851276c1
-
SHA512
7bbad34c6a6f4d5e8316771ffbad11010d8527f3a713b53f115dfa98d2a7bbc6f4596503a3ada325cebe41d472d7e930311e3734f4f24fec8eb90170b2485eba
-
SSDEEP
24576:W39YCqk2eQc9YQqzQ2ZBLjXyRnMIT98ZsXBHbrQ:Nrk9OtZdzKnMLZ8ZQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-