General
-
Target
1515d9068c8c85fbb2da782bff9d5c2d451a90dd8faf56fbde91d81b0902f2eb
-
Size
657KB
-
Sample
231205-vsac8ach9w
-
MD5
99b674fd2f04bf53e7d84a2ca1593da0
-
SHA1
1b702b646bbcd2e922886747e6e944e02677f63d
-
SHA256
1515d9068c8c85fbb2da782bff9d5c2d451a90dd8faf56fbde91d81b0902f2eb
-
SHA512
4239b83fd356832af9c87144158e69002a0cea0b4db205dc8dfcf1c955bd07ba4447db0f3c93fbf9a24e9cd2435b9b943f0eaeb6bd6fdf0f9248721ecfc814b8
-
SSDEEP
12288:NPfUT66zTgcGVZscSc/leiK5XDy5aTBFAw1uOjvq3ZLEb92+q:iPzrGTfS6eiaTy5aPAPi49EwV
Static task
static1
Behavioral task
behavioral1
Sample
quote.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
quote.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
kV$bSqJ1 daniel - Email To:
[email protected]
Targets
-
-
Target
quote.exe
-
Size
740KB
-
MD5
b8544d8facfb793edab9d38921933728
-
SHA1
5ab5b9c19dd1cf189b49be90233e32dacd32e9e6
-
SHA256
a81e919be20c26807dc7d775ccdc026d4a9daf0116661dff5e3fbdaf29effe19
-
SHA512
f59aee69180a55f43c35ee32cb0a3a4b58994fd25a195d7557719a0f7b6c482fe561fd13a239772e32a04512391ffaed520ab85399eb0dbff75356585e88ac6f
-
SSDEEP
12288:DWVretW8G34/uK45+po2ys7l/yOKRXDGz5aTbFQG1uJ073ZCeg/:4x34/up+pJyoaOMTGz5atQZJ0r
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-