General
-
Target
5e677270292e15434757d07857994ecd05b20c0872120d9858b94f56186ff6aa7z.7z
-
Size
448KB
-
Sample
231205-wqka3seb65
-
MD5
2bda9ab0ecfb10e452c32de33eb5c0ab
-
SHA1
6e383b02f1786d4139f33f653e5189f88f88d352
-
SHA256
5e677270292e15434757d07857994ecd05b20c0872120d9858b94f56186ff6aa
-
SHA512
6ede77c253bc9811245900d9e09e41cacd8c796636fa35d2721fba7fdaaafe4daef9880ede8dda5bbd4343fbbf7fa9ea8d47dd74cd867fa2337b65228afc38a2
-
SSDEEP
12288:hFwx63ZFWBmpRUdA3uNUn6yKasnhN4o6RzC4b:LwxR0RwquUwnh+RG4b
Static task
static1
Behavioral task
behavioral1
Sample
payment confirmation.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
payment confirmation.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Targets
-
-
Target
payment confirmation.exe
-
Size
787KB
-
MD5
bc093d7923b582bc37b09a814940a4e4
-
SHA1
4ff679166f942395b2d335757f759f39fe8dcdd4
-
SHA256
d9961b923d5187cab6c6216a4de0f61a03a24fd3cf6765a5c3eb0963e05f580c
-
SHA512
4f1eb3dd9df2bb7f80a47d39083522c3255102bed9c29fefda6513f4a0224287138c64911360acec8140f76f8b2d483d14f28a30ea12d66661015d3592401af7
-
SSDEEP
12288:QWodJz/ZGPpglaJwnQieFtD6Ba+FdEmp2UdAmhu1qCvRUULCeNPSiyyjK:QzEpglw53t2I02wfU1PnNPd8
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Suspicious use of SetThreadContext
-