General
-
Target
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234.exe
-
Size
804KB
-
Sample
231202-jd756aae4x
-
MD5
1d12b8064c33cef04ff272bb099d4541
-
SHA1
7b80053875042ab5946d73b4bc9f5d06abf13eff
-
SHA256
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234
-
SHA512
b17aee1f64c337874dd579e84487ec1ba4e891294239945e771a15ca034b83ee4673707272650a7f87deeca01087d9d43bb22f917515817083deef7d1c735189
-
SSDEEP
12288:mDLUbbwLijB0wHjMpiGTd8dX/LhcqeFxXzXNuVPmdfBoItMUFt6Ysbwj366lHNNV:YLmiwO2xhc/XzXoIyUFtHsU7
Static task
static1
Behavioral task
behavioral1
Sample
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.amtechcards.com - Port:
587 - Username:
[email protected] - Password:
]i[a(tUWlmp% - Email To:
[email protected]
Targets
-
-
Target
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234.exe
-
Size
804KB
-
MD5
1d12b8064c33cef04ff272bb099d4541
-
SHA1
7b80053875042ab5946d73b4bc9f5d06abf13eff
-
SHA256
9fd0c32521c7d152ba2b6d68f90cc43f6ead072c6030601ae0724889debe4234
-
SHA512
b17aee1f64c337874dd579e84487ec1ba4e891294239945e771a15ca034b83ee4673707272650a7f87deeca01087d9d43bb22f917515817083deef7d1c735189
-
SSDEEP
12288:mDLUbbwLijB0wHjMpiGTd8dX/LhcqeFxXzXNuVPmdfBoItMUFt6Ysbwj366lHNNV:YLmiwO2xhc/XzXoIyUFtHsU7
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-