General
-
Target
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837
-
Size
733KB
-
Sample
231202-b8ehbshc8v
-
MD5
ed39d859cbe806a041e3d3ec1f685d2d
-
SHA1
f84d951a06de0cd52a1ad630e85f2842bcf9d978
-
SHA256
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837
-
SHA512
053e657557801a0af542e43130f33b501f58244d71cc912dee1e26541a105f0dcf54d72430c0c26ea3ff6824119c029938743e5e38d081ecdf6dba83a8ab3663
-
SSDEEP
12288:DV7IPkFPlmKGakmcs/N0l7J0PAiK8dcMaK3AC28HkfiurF8p:fgKGaQG0lWU8d/AL5Pr6p
Static task
static1
Behavioral task
behavioral1
Sample
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.europeanhome.vn - Port:
587 - Username:
[email protected] - Password:
Qsa@@123@! - Email To:
[email protected]
Targets
-
-
Target
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837
-
Size
733KB
-
MD5
ed39d859cbe806a041e3d3ec1f685d2d
-
SHA1
f84d951a06de0cd52a1ad630e85f2842bcf9d978
-
SHA256
074a4b15f22d418584aa46e6b8776a1b3ccd91124d21993de215b6dcba789837
-
SHA512
053e657557801a0af542e43130f33b501f58244d71cc912dee1e26541a105f0dcf54d72430c0c26ea3ff6824119c029938743e5e38d081ecdf6dba83a8ab3663
-
SSDEEP
12288:DV7IPkFPlmKGakmcs/N0l7J0PAiK8dcMaK3AC28HkfiurF8p:fgKGaQG0lWU8d/AL5Pr6p
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-