General
-
Target
ead564f559716798f5c081cb7e4171c536751d82ca291a39ff6c401f527fed9c
-
Size
657KB
-
Sample
231205-waklxadd8t
-
MD5
2c1e5ae37ead21e9e2d41b0447bbff76
-
SHA1
9f8cfb4427cc496bde807d203a5cc146b7895c9b
-
SHA256
ead564f559716798f5c081cb7e4171c536751d82ca291a39ff6c401f527fed9c
-
SHA512
482c49397963b0580c82890fd1bdae0ecbc7469e72a3afc3375b92d534848633951352ca6d843cbe8f64eae7c5d52d2b2556900badb9ca33394bff3d3b2f0d01
-
SSDEEP
12288:BPfUT66zTgcGVZscSc/leiK5XDy5aTBFAw1uOjvq3ZLEb92+S:ePzrGTfS6eiaTy5aPAPi49Ew7
Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
PO.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
kV$bSqJ1 daniel - Email To:
[email protected]
Targets
-
-
Target
PO.exe
-
Size
740KB
-
MD5
b8544d8facfb793edab9d38921933728
-
SHA1
5ab5b9c19dd1cf189b49be90233e32dacd32e9e6
-
SHA256
a81e919be20c26807dc7d775ccdc026d4a9daf0116661dff5e3fbdaf29effe19
-
SHA512
f59aee69180a55f43c35ee32cb0a3a4b58994fd25a195d7557719a0f7b6c482fe561fd13a239772e32a04512391ffaed520ab85399eb0dbff75356585e88ac6f
-
SSDEEP
12288:DWVretW8G34/uK45+po2ys7l/yOKRXDGz5aTbFQG1uJ073ZCeg/:4x34/up+pJyoaOMTGz5atQZJ0r
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-