General
-
Target
required and measured value.7z
-
Size
686KB
-
Sample
231205-kx8fpsae42
-
MD5
3dfaacb300ab0b30f81de28ab5d72cb6
-
SHA1
e84cc8123bf33897df8ed7a5763107c1e3c108e7
-
SHA256
95c96f2d35f40ff0f47dc61ebea3ffee5e28aef7e899ea6624afc3e8321d6cbf
-
SHA512
62cc699831582fb7f209ad78244b1c4dcb78f2249fe9edba0576e4b29e30e4f4308fedc835df8efb6ee1888075279a91b0b6e7fa9e49bcd3268c10a1a37bdb87
-
SSDEEP
12288://lFP+Lxs7BlqZmYQSD2yhd6iXjjyzz92rpc/LnSXbI/VGis72dmSeenBh9dmcy3:/tFPuEPqZ7QSD2RiSUduL4ItGf72dmgu
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Targets
-
-
Target
required and measured value.exe
-
Size
1008KB
-
MD5
3521aff033bea60a6e8869378b9d068c
-
SHA1
9d84d60857b499e6c6c13d684e67f11f6d8ca31a
-
SHA256
502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3
-
SHA512
98f3c653b2a763ffa72aa0873f760e06221428066a2f8dc9fcf4c5ecc620684acbf572518057b6c9eac952587d14f033bc9648531cfb0e97f68be86588310e8b
-
SSDEEP
24576:Bqas+pJyCkF0ODvYHkAduLZgBGROSYOmT7Lmte9:wyJyCkF9VAd4ZgBG4SYOy7
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-