General
-
Target
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0
-
Size
674KB
-
Sample
231202-cwa5tahd9s
-
MD5
90842fb1307b60fef589421dbecf0670
-
SHA1
b1b60231e3d1eadd2ad214b22e915b91fe88e72a
-
SHA256
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0
-
SHA512
5cd0020157289e8b5a47be2467c7376abff50280dc86a77d34f60967dd9c836ab5529d71f021800f644829616cb744f513e533e62a721c4eae550f93711184e5
-
SSDEEP
12288:jCEbJGICDVhbbdSRzoL0bVXQ7cJcl8qIWq+n5zHWLIIircpuaN:DbJ4bIzI0BX0OcbhHWcA
Static task
static1
Behavioral task
behavioral1
Sample
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg3plcpnl0195.prod.sin3.secureserver.net - Port:
587 - Username:
[email protected] - Password:
V#[email protected]&Qo! - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
sg3plcpnl0195.prod.sin3.secureserver.net - Port:
587 - Username:
[email protected] - Password:
V#[email protected]&Qo!
Targets
-
-
Target
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0
-
Size
674KB
-
MD5
90842fb1307b60fef589421dbecf0670
-
SHA1
b1b60231e3d1eadd2ad214b22e915b91fe88e72a
-
SHA256
73577aac96eac7334ba21e0c3324ab5edec6eb933b96c37a58c8fa9cdbb948a0
-
SHA512
5cd0020157289e8b5a47be2467c7376abff50280dc86a77d34f60967dd9c836ab5529d71f021800f644829616cb744f513e533e62a721c4eae550f93711184e5
-
SSDEEP
12288:jCEbJGICDVhbbdSRzoL0bVXQ7cJcl8qIWq+n5zHWLIIircpuaN:DbJ4bIzI0BX0OcbhHWcA
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-