General
-
Target
NEAS.84b2a93616b088b6e2ac11eb984cf1f4a5483bba94d708b13a0c90c96124e249img.img
-
Size
1.2MB
-
Sample
231204-t28fyacg7s
-
MD5
4dce36fa1428d53ae8302b1be0978fa1
-
SHA1
ec985aa27cac16001351f70d541ea25782d88494
-
SHA256
84b2a93616b088b6e2ac11eb984cf1f4a5483bba94d708b13a0c90c96124e249
-
SHA512
f154f98bcdcfbc8d72af0466ad0ef0e807842e8190680d0e7de0d0b348eb860073fc666ec68196b62b48084b38b27987fd9c99b53f40858326b7a538ccbe1c14
-
SSDEEP
12288:wG3QmbCpAnMnaCyvb49Ho/3dyfoPKcarxvHMMQ+eUW:pMna30HI34wyRtrQ+e
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE_23.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
QUOTE_23.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Targets
-
-
Target
QUOTE_23.EXE
-
Size
673KB
-
MD5
17762a7d03c45f872604d511abfee9bd
-
SHA1
3ebb2089ac3af30ba7899cd6313dde353083f8e2
-
SHA256
4072d54cdf2a168636a24c4063e56694d071dd91d4337f2413d762841d5ed1ea
-
SHA512
92a96e0d2852d000da88a08eb604315d0fee1326c80f99385beb53cdb41c3349d5a139b6eceedd2e6f5a6daaafbe016e0ea87bf3a3e079f69a533a03e679f40e
-
SSDEEP
12288:cG3QmbCpAnMnaCyvb49Ho/3dyfoPKcarxvHMMQ+eUW:dMna30HI34wyRtrQ+e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-