General
-
Target
f7fde41b36cd3f2c1bef20de9acec2086f4903f53bd2c512ace2354b07d201eb
-
Size
728KB
-
Sample
231205-t6gtsacg97
-
MD5
95e730953a2b037f1226b3a388b772f8
-
SHA1
af1e1206b4947f6e62ce2f50ac84a1d4a8d45a3c
-
SHA256
f7fde41b36cd3f2c1bef20de9acec2086f4903f53bd2c512ace2354b07d201eb
-
SHA512
d38920d893f10c6cfae51929806329b5ccd94823f980f88fba3bff5c888de1289102a2b6d6097753d22d82f9070fd41a052538776050108780f44be991f2b69b
-
SSDEEP
12288:0dJh1ej1hPtBQkQ+Y3y56b2CzqTVwq+xfPvAm/NXU6PyrfKU6C0+SmLcsAp+8c:Uz1ahPtqkLEb2COZr+xfPv1/NXT46dUD
Static task
static1
Behavioral task
behavioral1
Sample
Parking List.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Parking List.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gimpex-imerys.com - Port:
587 - Username:
[email protected] - Password:
h45ZVRb6(IMF - Email To:
[email protected]
Targets
-
-
Target
Parking List.exe
-
Size
811KB
-
MD5
12ce994a7771f557860a1dd0a6d7fa86
-
SHA1
02fb55374e6fcc35838a86f61be0d1777c5b0ce1
-
SHA256
34cd5a3fe4b96b4fd09ec6ea72ee1cd3924d5a69cd1a27c894c44cc705e6b5f8
-
SHA512
6938c6c7a02b0260fe96563e36b438729b4a0251f59c5a74e1ea0bb845773ec3e6b5c88626984288b84088084c904ffd7f717655d7244bee03449d24b36f6302
-
SSDEEP
24576:o34/up+pJcQ52CON7+xxPBeGVWtbU5N7:o38PJyN7+xWMWtIj
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-