General
-
Target
PI No. 92826785.zip
-
Size
599KB
-
Sample
231205-l9mv7sag47
-
MD5
62d21b382da14f63435753cb1f0bc6a1
-
SHA1
925a330a4241884e1fce60113e6e8ff692decd8d
-
SHA256
f48ed8d111af1a7ac60eb253fa75cc0b65bc1418c214d55a6e59676f4dd7277c
-
SHA512
8fb2fa8917aaf4144b795bda172e123edfff3971682ade6336e372fb78a59595a835c91be58518b63bbb5834542f6dda59b9831b0b15de3da553ec76b0a5626a
-
SSDEEP
12288:5pt5bxkAk4dKbLT8DlN8bR1a99L44paac/ccf4lT:5p3xkJPbXGj8LaTc/ccf4lT
Static task
static1
Behavioral task
behavioral1
Sample
PI No. 92826785.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
PI No. 92826785.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.elec-qatar.com - Port:
587 - Username:
[email protected] - Password:
MHabrar2019@# - Email To:
[email protected]
Targets
-
-
Target
PI No. 92826785.exe
-
Size
623KB
-
MD5
92b364ff04da94c50941ac26728b398e
-
SHA1
0ef8a6e061b52e34a31b691cd03153ce7b22c70a
-
SHA256
7cba6ce993da55a8706e4c726e120ce59a40622f20ed4f0beb971c1fb03b9519
-
SHA512
75d82e51d905febbb0fd6f3f0450c325faad7307bf84a5e508fca0aa3a75645873661f84a1bace1faa3edc6d0c0d8d3606f00228618f24510611e631fe03d37c
-
SSDEEP
12288:Xl5nF8PVdqrlbLP8DL98J/1aswLR7HgaC/Me5Qes5ib46iJgw:Xlaqhb7Gp8DatpC/Me5GM/iJZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-