General
-
Target
5bbaedb23ca1594e649704f9d0d6bdc9fd1aeca05187b62169c44a98f2aba1a07z.7z
-
Size
291KB
-
Sample
231205-wp4y4aeb55
-
MD5
45e69fcd8af28b4dae56bfe23be896e0
-
SHA1
7c0fbb3a0912c545087ec17ecc81a197fb67ae0f
-
SHA256
5bbaedb23ca1594e649704f9d0d6bdc9fd1aeca05187b62169c44a98f2aba1a0
-
SHA512
0c92cb49efdebc1fd3fda25ffc0ad450fcc060ca1e9fb926d74ed00cb39012d34729ee484f9ee0b35d710cf6054506af4448b3de9cbe5f6f64e0bb75af733a6d
-
SSDEEP
6144:eWXdpXuzWP1IgTITG3kpmsymq70ybBnO0hTuaky:emn+zW1LIfG7PFhSby
Static task
static1
Behavioral task
behavioral1
Sample
FT23194060101821.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
FT23194060101821.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
kex#-rHjHM4qKk52 - Email To:
[email protected]
Targets
-
-
Target
FT23194060101821.exe
-
Size
357KB
-
MD5
019012e11fcf33bde064894821cd84b7
-
SHA1
082751450a7064dfbfeb43f34a34be2ba3b24eac
-
SHA256
31dd42f85893cd5e7db1645bb8eae25f792c11be8eeeb602ac89148afb60becb
-
SHA512
3eafa84ce7add46b1ce7798ed361b42505c6d5b148543ee6b1c0cb7ad3b030800d0e75a0778d2bf51a67409a055d9eac01d9f10f67a6e002af1d152ab6afea00
-
SSDEEP
6144:kARcM3CjleuEn1IETITGx5PmCyxq70y5BDG9DnSgiobI+H5/8b:VRcM3CC1zZXf70nypi2
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Suspicious use of SetThreadContext
-